This Scary Phishing Attack Is Impossible To Detect — Here’s How It Affects Your Browsers


Short Bytes: A Chinese security researcher has demonstrated a scary phishing attack that’s virtually impossible to detect in web browsers like Chrome, Firefox, and Opera. The attack uses such unicode characters in domains that look just like the common ASCII characters. For example, “” is equivalent to “а”. Chrome 58 has fixed the issue and the update is rolling out. It remains unaddressed in Mozilla Firefox.

Punycode is a method of depicting Unicode using the limited character subset of ASCII which is used for internet host names. It makes it possible to register domain names with foreign characters. For example, the domain name “” is same as “短.co”. Using the same, a security researcher has shown the proof-of-concept of a scary attack.

While the whole concept of the attack is very old, it has recently surfaced to the current versions of browsers like Google Chrome, Mozilla Firefox, and Opera. These browsers show unicode characters in domain names as normal characters, which makes it impossible to notice the notorious domains.

Due to this, it’s possible to register domains like “”, which is equivalent to “а,” the Chinese security researcher Xudong Zheng writes. Here’s the demo web page.unicode phishing attack

In the picture above, ‘а’ uses Cyrillic ‘а’ (U+0430), instead of the ASCII ‘a’ (U+0041). This is also called a homograph attack.

So, are our web browsers totally incompetent against such attacks? Well, most browsers have some protection mechanisms enabled but they don’t detect every version of such attacks. For example, if the attacker only replaces ASCII characters with characters from a single foreign language, the protection fails.


This attack vector, fortunately, doesn’t affect Internet Explorer, Microsoft Edge, and Safari web browsers.

This bug was reported to Firefox and Chrome on January 20. The bug has been fixed in Chrome 58, which is rolling out to the users. The issue remains unaddressed in Firefox.

However, Firefox users can tackle this bug by going to about:config and setting network.IDN_show_punycode to true.

Zheng recommends the use of a password manager. He also advises that users must pay close attention to a site’s URL when entering personal information. You can read more about the attack on Xudong Zheng’s blog.

Did you find this article on homograph phishing attack useful? Don’t forget to share your views.

Also Read: Best Hacking Tools Of 2017 For Windows, Linux, And OS X
Adarsh Verma

Adarsh Verma

Fossbytes co-founder and an aspiring entrepreneur who keeps a close eye on open source, tech giants, and security. Get in touch with him by sending an email — [email protected]
More From Fossbytes

Latest On Fossbytes

Find your dream job