The Homograph Illusion Not Everything Is As It Seems

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://unit42.paloaltonetworks.com/homograph-attacks/
• Blog Title: The Homograph Illusion: Not Everything Is As It Seems
• Suggested Section: generic-methodologies-and-resources/phishing-methodology/homograph-attacks.md

🎯 Content Summary

Executive Summary

Since the inception of email, homograph attacks have been a prevalent method of initial access and malware distribution. Attackers replace Latin characters with visually identical non-Latin Unicode homoglyphs—such as Greek Η (U+0397) for ‘H’ and Cyrillic о (U+043E) for ‘o’—to evade automated filters and deceive users by fabricating legitimate-looking display names, subjects, headers and URLs.

Wha...

🔧 Technical Details

Homograph Substitution Attack:
Non-Latin Unicode homoglyphs from scripts like Cyrillic (e.g., 'а' U+0430), Greek (e.g., 'Η' U+0397), Armenian (e.g., 'Տ' U+054F) or Cherokee (e.g., 'Ꭲ' U+13A2) replace Latin letters in display names, subjects and domains to bypass content filters and visually impersonate trusted entities.

Multi-Stage Phishing Chain with Custom CAPTCHA and OTP:
Attackers craft emails with homograph-manipulated names and subjects, e...

🤖 Agent Actions

Added in-depth coverage of Unicode homograph/homoglyph phishing techniques:

1. Created new file:
   • src/generic-methodologies-and-resources/phishing-methodology/homograph-attacks.md
   – Explains technique, Unicode ranges, detection logic with Python examples, mitigation steps, and real-world case studies.
   – Includes reference section with Unit42 blog and related resources.

2. Updated existing Phishing Methodology page:
   • Inserted cross-reference link right after the “Homoglyph” bullet under Domain Name Variation Techniques so readers can easily access the new detailed guide.

These updates enrich HackTricks with practical detection and mitigation strategies for homograph-based phishing attacks.

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://unit42.paloaltonetworks.com/homograph-attacks/

Content Categories: Based on the analysis, this content was categorized under "generic-methodologies-and-resources/phishing-methodology/homograph-attacks.md".

Repository Maintenance:

• MD Files Formatting: 861 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge