What Is a Homoglyph Attack?
A homoglyph attack is an impersonation technique in which an attacker replaces characters in a domain name, email address, username, or other identifier with visually identical characters from a different script or character set. A reader sees the lookalike as the trusted original, while software treats it as an entirely separate string. The technique is also called an IDN homograph attack (opens in new tab) or script spoofing, and it reaches any place text identifies something, from domains and email senders to usernames, software packages, and file names.
How a homoglyph attack works
Unicode assigns distinct code points to characters that can share the same visual shape, and security systems use the Unicode Consortium's confusables data (opens in new tab) to map those relationships across Latin, Cyrillic, Greek, Armenian, and other scripts. The Cyrillic "а" (U+0430) renders the same as the Latin "a" (U+0061) in most fonts, so a domain built from Cyrillic lookalikes can appear identical to a real brand's while resolving to attacker-controlled infrastructure. The attacker picks a target identifier, swaps one or more characters for confusable twins, and registers the result; because the code points differ, software treats the lookalike as a separate string unless it applies confusable-character detection.
For domains, Punycode (opens in new tab) converts the Unicode labels of an internationalized domain name (IDN) into ASCII strings prefixed with "xn--". Browsers then render the Unicode form (opens in new tab) in the address bar, so the user sees the familiar brand name. In 2017, researcher Xudong Zheng registered a lookalike (opens in new tab) that replaced every letter of the "apple" label with a visually identical Cyrillic character; Chrome, Firefox, and Opera rendered it as "apple.com", and he served the page over HTTPS, so a padlock appeared beside the spoofed address. Chrome added whole-script confusable detection (opens in new tab) in version 58 in response.
Some lookalike attacks need no Punycode at all. ASCII-range pairs such as "rn" for "m", "vv" for "w", or "1" for "l" can be registered as ordinary domains, and because they use no IDN, they fall outside IDN-specific browser checks. Lookalike domain acquisition (opens in new tab), homograph domains included, maps to MITRE ATT&CK technique T1583.001.
Why homoglyph attacks are hard to stop
A homoglyph attack can produce a pixel-identical identifier (opens in new tab) that looks indistinguishable from the real one. Typosquatting domains, combosquatting domains, and missing-dot domains all differ visibly from the target and rely on user error or careless reading; a homoglyph domain instead deceives users who read the address carefully, follow a link, or copy and paste it, because the text itself looks correct.
Standard trust signals fail as well. Domain-validation certificates confirm only control of the domain (opens in new tab), not the identity behind it, so a homoglyph domain can obtain its own certificate and present a padlock. DMARC (opens in new tab) blocks direct spoofing of a domain you own but does nothing about a separately registered homoglyph lookalike, which authenticates cleanly as itself.
Scale compounds the problem. Homoglyph permutations of a single brand are cheap to generate and register, so brand impersonation through lookalikes arrives in volume rather than one domain at a time. Attackers also layer the substitutions across an email (opens in new tab): the sender display name, the subject line, and the body of a single phishing message can all carry Cyrillic or Greek lookalikes that slip past filters which never decode or normalize confusable characters.
Types of homoglyph attacks
Domain spoofing is one vector, but confusable characters work anywhere text identifies something:
- IDN homograph domains. Unicode lookalike domains that impersonate a brand's website for credential harvesting and malware delivery, or that support business email compromise.
- Email address and display-name spoofing. Lookalike characters in the From: header or display name. The email client can deepen the deception: Outlook has shown (opens in new tab) the contact card of a real person when a lookalike IDN sender matches one already saved in the recipient's contacts.
- Malvertising through lookalike domains. Attackers buy search ads against brand-name queries; the ad shows the legitimate domain while the click lands on a Punycode lookalike serving malware or credential-harvesting pages.
- Software supply chain attacks. Homoglyph package names in registries that allow Unicode identifiers, and homoglyphs inside source code itself: the Trojan Source vulnerability (opens in new tab) (CVE-2021-42694) lets an attacker define two functions whose names look identical to a human reviewer but distinct to the compiler.
- File name obfuscation. A related display-spoofing trick that uses a directional control character rather than a substituted homoglyph: the Unicode right-to-left override (U+202E) reverses a displayed file extension so an executable reads as a document, catalogued as MITRE ATT&CK T1036.002 (opens in new tab).
- Social media and app store impersonation. Confusable characters in usernames, handles, and app listings.
How to defend against homoglyph attacks
Effective programs layer several controls across this surface:
- Unicode-aware monitoring. Enumerate homoglyph permutations of your domains with the Unicode confusables data and the skeleton algorithm in UTS #39 (opens in new tab). Plain string matching and edit-distance scoring miss confusable substitutions, and NFKC normalization leaves gaps the skeleton algorithm closes.
- Certificate Transparency (CT) monitoring. Watching public CT logs (opens in new tab) surfaces certificates issued for lookalike domains, often earlier than traditional blocklists flag them.
- Defensive registration and browser policy. Register the highest-priority homoglyph variants of your core domains, then enforce Punycode display in managed browsers: Chrome's IDN policy (opens in new tab) applies whole-script-confusable checks, and Firefox exposes (opens in new tab) a network.IDN_show_punycode preference.
- Takedown with escalation paths. Since the April 2024 amendments to ICANN's Registrar Accreditation Agreement, registrars must (opens in new tab) act on well-evidenced phishing reports, with escalation to ICANN Contractual Compliance when a registrar fails to.
Email authentication (opens in new tab) on your own domains is the baseline; homoglyph monitoring separately closes the lookalike gap.
How Doppel helps
Doppel is the AI-native Social Engineering Defense (SED) platform that unifies Digital Risk Protection and Human Risk Management, detecting homoglyph and lookalike domains alongside fake social profiles, scam ads, and counterfeit apps on the same attacker infrastructure. The Doppel Threat Graph correlates those signals into a single campaign view that exposes the multi-channel operation behind a spoofed domain.
Its agentic AI prioritizes and executes takedowns at machine speed, dismantling the infrastructure behind homoglyph campaigns while analysts handle the escalations that need human judgment. Detected threats also feed employee readiness, turning a live homoglyph campaign into a training simulation for the people it targets.
A guided demo shows how Doppel detects and correlates live impersonation threats targeting your brand, then walks through takedown. Request a demo to get started.
Frequently asked questions about homoglyph attacks
What is a homoglyph attack?
A homoglyph attack swaps characters in a domain, email address, package name, or username for visually identical characters from another alphabet, such as the Cyrillic "а" in place of the Latin "a". Because the two characters carry different Unicode code points, computers treat the strings as unrelated while people read them as the same word. Attackers use it to register lookalike domains, spoof sender addresses, and impersonate brands and executives, and it holds up even when the victim reads the address carefully or copies and pastes it, since the visible text looks exactly right.
Is a homoglyph attack the same as a homograph attack?
In practice the terms are used interchangeably, along with script spoofing and IDN homograph attack. Strictly, a homoglyph is a single character that visually resembles another, and stringing those characters into a domain, username, or other identifier is what produces a homograph attack. "Homoglyph" is the more precise term for cross-script character confusion, since "homograph" traditionally describes words spelled alike within one language (opens in new tab). Either way, the threat is the same: identifiers that look genuine but resolve to attacker-controlled resources.
What is the difference between a homoglyph attack and typosquatting?
Typosquatting registers misspellings of a domain, a transposed or dropped letter, and waits for users to mistype the address. A homoglyph attack substitutes visually identical characters, so the fraudulent address looks exactly like the real one and needs no user error; attackers instead push the link through email, messaging, and ads. String-similarity scoring can flag typosquats, while homoglyph domains require Unicode-aware analysis such as the UTS #39 skeleton algorithm. One registration can do both at once, since pairs like "l" and "I" sit close on the keyboard and look alike.
What is an example of a homoglyph attack?
The best-known proof of concept is Xudong Zheng's 2017 all-Cyrillic domain that displayed as "apple.com" in Chrome, Firefox, and Opera over HTTPS, prompting Chrome's version-58 whole-script detection (opens in new tab). In-the-wild cases include Punycode malvertising (opens in new tab) that used lookalike domains in search ads to push malware posing as a popular password manager, and a NuGet supply-chain attack (opens in new tab) that impersonated the Nethereum package with a Cyrillic "е" to steal cryptocurrency wallet keys.