Homoglyph Attack

The foundational mechanism of a homoglyph attack involves replacing standard ASCII characters with visually identical glyphs from non-Latin scripts. For example, the Latin letter 'a' (U+0061) can be swapped with the Cyrillic 'а' (U+0430). To the human eye, the text appears identical, but to a string-matching algorithm, the byte sequence is entirely different. This allows attackers to bypass blocklists that scan for specific keywords like 'delete' or 'drop table' by encoding them as 'dеlеtе' using Cyrillic 'е' characters.

A classic application of this vector targets the domain name system. Attackers register domains using a mix of scripts—such as Latin, Cyrillic, and Greek—to create a URL that is pixel-perfect to a trusted brand. For instance, the domain 'paypaI.com' uses an uppercase 'I' to mimic a lowercase 'l'. More sophisticated attacks use entirely Cyrillic strings that render identically to Latin script. These domains are then used in phishing campaigns where even vigilant users cannot visually distinguish the fake URL from the real one in the browser bar.

The Unicode Consortium maintains a formal list of 'confusable' characters to help defend against these attacks. A skeleton is a normalized representation of a character that strips away stylistic differences, reducing visually similar glyphs to a single prototype. For example, the Latin 'o', Greek 'ο', and Cyrillic 'о' all share the same skeleton. Defensive algorithms use skeleton matching to detect homoglyph attacks by converting all text to its skeletal form before performing string comparisons, effectively neutralizing the visual deception.

The primary defense is Unicode normalization (specifically NFKC or NFKD forms) which decomposes and recomposes characters to their canonical equivalents. This process can collapse many homoglyphs into their ASCII base forms. A robust security pipeline should:

• Apply NFKC normalization to all user inputs before analysis.
• Strip or flag mixed-script text (e.g., text containing both Latin and Cyrillic characters).
• Implement skeleton-based comparison against a denylist of dangerous commands.
• Use perplexity filtering to detect the unnatural character distributions common in obfuscated payloads.

The defensive preprocessing step that converts text to a canonical form before security analysis. By decomposing or composing characters into a standard representation (e.g., NFKC normalization), the system collapses visually identical homoglyphs into their base ASCII equivalents. This ensures that 'рaypal.com' (with Cyrillic 'р') is normalized to 'paypal.com' before reaching a content filter, neutralizing the obfuscation.

A security mechanism that uses the Unicode Consortium's official confusables table to identify characters with visually ambiguous glyphs. Instead of relying on normalization alone, this method proactively flags strings containing characters designated as 'confusable' with Latin script. For example, the Greek letter 'ο' (omicron) is flagged as confusable with Latin 'o', triggering a review even if the string is technically valid Unicode.

A heuristic that identifies strings containing characters from multiple Unicode scripts within a single identifier. Legitimate domain names or commands rarely mix Cyrillic, Latin, and Greek scripts. A string like 'micrοsoft.com' triggers an alert because it combines Latin and Greek characters. This defense is particularly effective against whole-script homoglyph attacks where entire words are spoofed using a single foreign script that visually mirrors Latin.

A defensive user interface practice that forces browsers and applications to display the raw Punycode encoding (e.g., 'xn--80ak6aa92e.com') instead of the rendered Unicode for Internationalized Domain Names (IDNs). By showing the underlying ASCII representation, users and automated systems can immediately see that a domain is not the legitimate Latin-script version, preventing visual spoofing attacks at the display layer.

An advanced detection technique that reduces each character to its visual skeleton—a simplified, prototypical shape. Characters that share the same skeleton (e.g., Latin 'a', Cyrillic 'а', and Greek 'α') are treated as identical for comparison purposes. This method goes beyond simple confusable lists by dynamically generating visual fingerprints, catching novel homoglyph combinations that haven't been explicitly catalogued in static lookup tables.

A sanitization step that removes invisible Unicode control characters often paired with homoglyph attacks to further obfuscate malicious payloads. Characters like Zero-Width Space (U+200B) and Zero-Width Joiner (U+200D) can break keyword matching without visible indication. Stripping these before analysis prevents attackers from bypassing filters by inserting invisible breaks inside blacklisted terms like 'mali​cious'.