New Unicode Characters Let Attackers Create Convincing Lookalike Domains for Phishing
Researchers showed Chromium can display Unicode brand lookalike domains as readable text, bypassing Punycode warnings.
Ian Muscat and Leanne Briffa of Have I Been Squatted found gaps in Chromium's internationalized-domain display rules. Chrome 154 rendered a Cyrillic lookalike of apple.com as Unicode rather than Punycode xn--80a6aa68c8d.com, because one allowed Cyrillic letter is absent from the whole-script confusable list and skeleton matching failed. They registered 20 proof-of-concept names resembling brands including Apple, Okta, and OpenAI for testing, not a live campaign. Gmail Web showed all 20 internationalized sender domains in Unicode, while Outlook Web showed encoded A-labels.
- Chrome 154 displayed a Cyrillic Apple lookalike in Unicode instead of Punycode.
- A Cyrillic letter missing from Chromium's confusable list disables the whole-script check.
- Skeleton comparison missed hooked letters, so Apple and Okta lookalikes did not match.
- Gmail Web showed IDN senders in Unicode; Outlook Web showed Punycode.
- A .com review found 161,894 visual lookalike pairs across 133,953 ASCII domains.
- Organizations
- Have I Been SquattedAppleOktaOpenAI
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | okta.com | result, oƙta[.]com does not reduce to the same skeleton as okta[.]com, while the bar from ө also stops аррӏө[.]com from matchin |
| domain | ta.com | om letters with hooks or strokes can remain. As a result, oƙta[.]com does not reduce to the same skeleton as okta[.]com, while |
| domain | xn--80a6aa68c8d.com | e 154 displayed it in Unicode instead of its Punycode form, xn--80a6aa68c8d[.]com. The domains were registered for controlled testing, not |
| domain | xn--80ak6aa92e.com | atin letters in apple. Chromium now detects it and displays xn--80ak6aa92e[.]com instead. The research found that this rule works only whe |
From the original article
3 min read at cybersecuritynews.com
Security researchers have found new ways to build fake domains that resemble trusted brands while still appearing as readable Unicode in Chromium-based browsers. The issue can make phishing pages look real because users may see a familiar name and no clear browser warning during normal web browsing. Research by Ian Muscat and Leanne Briffa of […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.