New Unicode Characters Let Attackers Create Convincing Lookalike Domains for Phishing

Security researchers have found new ways to build fake domains that resemble trusted brands while still appearing as readable Unicode in Chromium-based browsers. The issue can make phishing pages look real because users may see a familiar name and no clear browser warning during normal web browsing.

Research by Ian Muscat and Leanne Briffa of Have I Been Squatted tested internationalized domain names, or IDNs, against Chromium’s display rules. Their proof of concept included аррӏө[.]com, a Cyrillic copy of apple[.]com.

Chrome 154 displayed it in Unicode instead of its Punycode form, xn--80a6aa68c8d[.]com. The domains were registered for controlled testing, not a real phishing campaign.

New Unicode Characters Make Domain Look Real

The Domain Name System first used English letters, numbers, and hyphens. IDNs later allowed letters from many languages. Punycode converts Unicode names into ASCII that DNS can handle, with encoded labels starting with “xn--.” This supports a global internet, but creates risk because letters from different scripts can look alike.

This method is called a homograph or homoglyph trick. Cyber Security News previously covered new homoglyph attack methods and a phishing trick using a Japanese character that looked like a slash.

Chromium tries to stop these tricks by showing suspicious IDNs as Punycode. Its rules check mixed scripts, unsafe symbols, whole-script copies, and a comparison form called a skeleton. It also compares skeletons with popular domains. The checks use ideas from Unicode Technical Standard 39.

Chrome added a whole-script confusable check after the famous 2017 аррӏе[.]com test. That older domain used only Cyrillic letters that looked like the Latin letters in apple. Chromium now detects it and displays xn--80ak6aa92e[.]com instead.

The research found that this rule works only when every character in a Cyrillic label appears on Chromium’s lookalike list. The Cyrillic letter ө, used in languages including Kazakh and Mongolian, is allowed but is not on that list. Replacing the final Cyrillic е with ө makes the whole check stand down, even though the result can still look like apple[.]com to a person.

A second gap appears in skeleton matching. Chromium removes many accents before comparing names, but marks from letters with hooks or strokes can remain. As a result, oƙta[.]com does not reduce to the same skeleton as okta[.]com, while the bar from ө also stops аррӏө[.]com from matching apple[.]com.

The researchers registered 20 proof-of-concept names. They included Unicode lookalikes for Apple, OpenAI, Skype, SharePoint, Pinterest, SpaceX, Shell, Okta, Nike, and Kickstarter. Their tests also found that Chromium’s later navigation warning did not catch аррӏө[.]com because its skeleton was two edits away from Apple, while that check looks for a closer match in this case.

The risk also reaches email. In tests with 20 internationalized senders, Gmail Web displayed every sender domain in Unicode, while Outlook Web showed every one as an encoded A-label. Gmail showed Punycode only in the separate “mailed-by” field, which many users may never open. The test did not measure spam filters, sender reputation, or link scanning.

A valid certificate does not prove that a domain belongs to the brand it resembles. It only confirms that the browser has an encrypted link to the domain named in the certificate. Attackers who own a lookalike domain may also configure SPF, DKIM, and DMARC correctly, so email authentication alone cannot prove that the sender is the real company.

An October 2026 review of .com found 167,226,216 delegated names, including 733,509 IDNs in xn-- form. Researchers identified 161,894 visual lookalike pairs covering 133,953 ASCII domains. These matches are not proof of crime because they may include defensive registrations, real multilingual sites, or unrelated companies.

Organizations should monitor new xn-- domains that resemble their brands, review certificate records, and enable impersonation protection in mail gateways. Teams can tag unexpected IDN senders, keep external sender labels enabled, and inspect DNS and proxy logs for encoded names. Defensive registration can also help with the closest brand copies.

Users should avoid signing in through links in unexpected messages. Opening a saved bookmark or typing the known address is safer. Password managers and passkeys add strong protection because they match the real domain and should not fill or respond on a different lookalike site. Browser updates remain important, but this research shows that reading the address bar alone is no longer enough.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC

The post New Unicode Characters Let Attackers Create Convincing Lookalike Domains for Phishing appeared first on Cyber Security News.