@disarray they're talking about the emoji stealer MRF that was mostly broken, so the RCE would have required an admin to set it up with a whitelist to a malicious instance, whose admin would later add a malformed emoji to replace something like the inbuilt captcha binary

so yeah, psyop