Homoglyph watermarks still favor scripts used by higher-resource languages
After copy-paste strips invisible characters, detection needs about 2 English or Persian code points but 93 Lao.
Stories per day · 30 days
Relatedconfusables1email-security1homoglyphs1homograph1identifiers1idn1invisible-characters1multilingual1watermarking1
11 stories, newest first · one card per story
Stories tagged #unicode
Unicode Consortium publishes UTS #39 version 18.0.0
Version 18.0.0, dated August 27, specifies identifier security profiles and confusable and mixed-script detection.
New Unicode Characters Let Attackers Create Convincing Lookalike Domains for Phishing
Researchers showed Chromium can display Unicode brand lookalike domains as readable text, bypassing Punycode warnings.
CVE-2026-105241: Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch
Apache log4net CVE-2026-105241 lets unencodable Unicode discard an entire SmtpPickupDirAppender email batch.
CVE-2026-19954: Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names
Perl Net::Whois::Raw before 2.99044 queries WHOIS for the wrong domain on Unicode names.
Fake Zoom installer hides macOS backdoor CloudSyncD
Jamf analyzes CloudSyncD, a fake macOS Zoom installer that steals passwords and deploys a backdoor.
2
CloudSyncD Uses Invisible Unicode to Hide Phished Mac Passwords in Plain Sight
CloudSyncD, a fake Zoom macOS backdoor, hides phished passwords with invisible Unicode and calls live C2.
Attackers conceal phishing lures using invisible Unicode characters
Threat actors use invisible Unicode characters (ASCII smuggling) to hide phishing lures and evade email security filters.
1
ASCII smuggling isn't just an AI security risk
Microsoft tracked a phishing campaign peaking at 2.37 million daily messages that hid financial-lure keywords with invisible Unicode tag characters to evade filters.
2
Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters
Microsoft warns of a high-volume phishing campaign using invisible Unicode characters to split keywords like 'funding' and evade filters, peaking at 2.37 million daily messages.
3
ASCII smuggling crosses over from AI prompt injection to phishing evasion
Microsoft details high-volume phishing campaign using ASCII smuggling (Unicode tag chars) for filter evasion, peaking at 2.3M messages.
4