Homoglyph Attacks Use Lookalike Letters to Spoof Trusted Links
A link can pass every casual test and still be a trap. It carries no odd numbers, no extra subdomains, nothing bolted on. The trick is smaller and older than that: one character is not the character it appears to be.
Hilary Osborne, writing in the Guardian on 20 September 2026, describes an email that passes every casual test. The link carries no odd numbers, no extra subdomains, nothing bolted on. The trick is smaller and older than that: one character is not the character it appears to be. Her own headline demonstrates it, with the “a” in “Read” replaced by the Cyrillic “α”. Fraudsters borrow letters from other alphabets to build URLs and email addresses that look nearly identical to the real thing. Anyone who clicks lands on a spoof site or a spoof inbox, and from there personal details get harvested. This class of deception has a name: the homoglyph attack. A homoglyph is a character that looks the same as, or almost the same as, another one.
The mechanism is not exotic. Cyrillic “с” and Latin “c” are indistinguishable in most typefaces, and Cyrillic “а” and Latin “a” are close enough that a glance will not separate them. The idea itself is not new. When internationalised domain names were introduced, researchers warned that they would let an attacker register a name rendering identically to a trusted one. The defence proposed at the time was, in essence, honesty in rendering. Two decades later, that defence still sits mostly in the browser.
Jake Moore, global security adviser at ESET, says fraudsters “love Microsoft” as a brand to spoof. In his example, a fake site swaps the Cyrillic “с” for the Latin “c” — miсrosoft against microsoft. Moore argues the shift toward links is structural. Most phishing attacks now point people to links instead of attaching files. Attachments can be scanned and caught; a malicious link has to be judged by a human. So criminals build websites whose links look genuine and then ask, casually, for a click.
Marijus Briedis, chief technology officer at NordVPN, calls the technique “really more of a psychological trick than a technical one”. “They’re betting that when we’re in a rush, our brains see what we expect to see,” Briedis says
The fraudster wins, briefly, with credentials. The spoofed brand loses reputation it never spent. The victim loses time, money and the confidence to trust any link at all. Browser vendors and registrars decide, through rendering rules and registration policy, how easy the trick remains. Fonts decide too. Moore notes that some typefaces make the substitution almost impossible to spot; in an email address set in Comic Sans, the Cyrillic “a” does not look out of place at all. “We’ve spent years telling people to check the website before trusting it,” he says. The problem, he adds, is that a user can check and still be fooled, because it looks exactly as it should.
Four variables decide how long the trick keeps working. Browser behaviour determines whether mixed-script names get flagged or rendered as punycode by default. Registration policy determines who is permitted to mix scripts inside a domain at all. The phishing kits themselves are cheap and modular, so they spread quickly. And the psychology may shift, because the technical fix is partial and always will be. The uncertainty around this technique is real, and browser updates remain the most reliable line of defence, since they flag suspicious destinations and absorb the criminals’ latest workarounds.
The homoglyph attack works because the letter was never the point. What the reader sees is a trusted name; what the machine reads is a different string. That gap between human perception and machine parsing is the entire vulnerability, and it closes only when rendering rules, registration policy and user caution move together.
Sources
1. Guardian — Quote source (original article)
Mentioned organisations (context, not sources)
- ESET — Organisation (homepage)