fields of disarray (npub108e…nss3) they're talking about the emoji stealer MRF that was mostly broken, so the RCE would have required an admin to set it up with a whitelist to a malicious instance, whose admin would later add a malformed emoji to replace something like the inbuilt captcha binary
so yeah, psyop