Attackers conceal phishing lures using invisible Unicode characters
Attackers are using invisible Unicode characters to hide malicious links in phishing emails, making them harder for email filters to detect. This trick lets scammers disguise fake login pages or malware downloads in plain sight.
- Report priority
- Medium
How it works
- Attackers insert invisible Unicode characters into phishing emails.
- These characters appear as spaces or dots but are not visible to the reader.
- Email security tools often miss them, so the fake links or attachments stay hidden.
- When clicked, the invisible characters help the attacker bypass filters and trick users into visiting malicious sites or downloading malware.
What to do
If you've received suspicious emails with links that look normal but might contain invisible Unicode characters, check your email for unexpected links, especially from unknown senders. If you click such a link, your device could be at risk of malware or data theft.
Do not click on links in suspicious emails. Hover over links to see the full URL, if it looks odd or has hidden characters, do not click. Use email security tools that detect invisible Unicode characters. If you suspect an email is phishing, report it to your email provider or IT team.
Technical details
An attacker sends an email pretending to be from a bank. The email contains a link to a fake login page, but the actual URL is hidden by invisible Unicode characters. The link looks like this: but is actually CHARACTER]com/login. When clicked, the user is redirected to the attacker's site.
Threat actors have adopted the ASCII smuggling technique in phishing campaigns, using invisible Unicode characters to evade email security filters.