I spent last week looking into something that should not be possible but is quietly active in the wild: phishing attacks where the malicious domain name looks identical to the real one even when you hover over the link. Not close enough, not a typo, but identical to the naked eye. The trick is Cyrillic alphabet substitution, and it is more common than most businesses realise.
How the Attack Works
This is an IDN (Internationalised Domain Name) homograph attack, also called a homoglyph attack. It exploits the fact that different alphabets share visually identical characters that have different Unicode code points. The Cyrillic alphabet has seven lowercase letters that are indistinguishable from their Latin counterparts in most fonts: a, c, e, o, p, x, and y. In uppercase, the number jumps to fifteen, including A, B, C, E, H, K, M, O, P, and T.
When an attacker registers a domain like “аmаzon.com” using Cyrillic characters instead of Latin ones, the DNS treats it as a completely different domain. But to anyone reading it in an email, a browser tab, or a document, it looks exactly like the real Amazon website.
These domains are possible because of Punycode, the encoding system that allows non-Latin scripts in domain names. A domain like “xn--pple-43d.com” renders visually as “apple.com” in browsers that display Unicode, while the actual destination is a phishing site controlled by the attacker.
Real Attacks in the Wild
This is not theoretical. Palo Alto Networks’ Unit 42 research team documented active homograph attacks in 2025 used for initial access. In one case, attackers used a Google account with Cyrillic-substituted display names and logos mimicking Google Drive to trick recipients into granting OAuth permissions to a malicious app. In another, they embedded Cyrillic homographs inside DocuSign-themed emails to bypass content filters and deliver malware.
Bitdefender researchers discovered in 2022 that all Microsoft Office applications were vulnerable to IDN homograph attacks, meaning links in Outlook, Word, Excel, OneNote, and PowerPoint displayed the spoofed domain name indistinguishably from the real one. Microsoft confirmed the finding, and the vulnerability demonstrated that even users trained to validate links before clicking could be deceived because the link preview in Office shows the Unicode display name, not the Punycode translation.
The threat landscape is getting worse. Generative AI now enables attackers to craft personalised, error-free phishing messages that achieve click rates of 54 per cent according to Microsoft’s MDDR 2025 report, compared to 12 per cent for manually crafted campaigns. Combine AI-generated content with visually identical domain spoofing and you have a potent attack package.
Why User Awareness Is Not Enough
The uncomfortable truth about Cyrillic homograph attacks is that they bypass the most common security advice: hover over the link and check the URL before clicking. If the email client displays the Unicode version of the domain name, what you see in the hover preview is identical to the legitimate domain. The difference is invisible to the human eye.
Modern browsers have improved. Chrome, Firefox, and Edge increasingly display Punycode (the xn-- format) for domains that mix scripts, which makes the spoof visible to a trained user. But email clients, document viewers, and messaging apps do not consistently apply the same protection.
How Businesses Can Defend
Defending against Cyrillic homograph attacks requires a layered approach because no single control catches them all.
Email Authentication
SPF, DKIM, and DMARC configured in strict rejection mode (p=reject) prevent domain spoofing at the email level. If an attacker tries to send from “аmаzon.com” impersonating your domain, DMARC will reject it before it reaches your staff. This is the single most effective technical control and is free to implement.
Email Security Gateways
Enterprise email security tools can flag or block messages containing mixed-script domains, Punycode domains in link bodies, or homograph patterns. Configure your gateway to treat any email containing IDN domains from external senders as suspicious.
Browser and OS Configuration
Force Punycode display in browsers. Chrome forces this by default for domains with mixed Latin and non-Latin scripts. Ensure your organisation’s browsers are up to date and that this setting is not disabled. Modern browsers render such domains as “xn--” prefixed strings rather than the Unicode lookalike.
DNS Filtering
DNS-level security tools can block known malicious domains, including homograph variants of legitimate sites. Services like DNS filtering, secure web gateways, and threat intelligence feeds that include phishing domains will catch many of these domains at the network level before a user ever clicks.
User Awareness with a Twist
Standard phishing training is not enough for homograph attacks because the visual cue is missing. Instead, train staff to:
- Type the domain directly into a browser rather than clicking links in emails
- Check the browser address bar for Punycode (the xn-- prefix) after following a link
- Verify unexpected requests through a secondary channel (phone call, Teams message)
- Report any email that feels off, even if it looks visually perfect
Monitor Domain Registrations
Organisations should monitor domain registrations that closely resemble their own domains, including internationalised variants. Services like DNSWatch and commercial brand monitoring tools can alert you when a homograph domain is registered so you can issue takedown requests or block it proactively.
The Bottom Line
Cyrillic homograph attacks are not going to become the dominant phishing vector, but they are a dangerous tool in the hands of sophisticated attackers and ransomware groups running targeted campaigns. The combination of AI-generated email content and visually identical domain spoofing creates a threat that traditional user awareness cannot address alone. The defence is technical: DMARC enforcement, email gateway screening, DNS filtering, and browser Punycode display are the controls that catch what the human eye cannot see.
The best phishing defence is the one that works before the user sees the email. If you are relying on your staff to spot a link that looks identical to the real thing, you have already lost.
Related Reading
- The AI Adoption Gap: Why Most Businesses Are Stuck in the Experimentation Phase
- Microsoft Copilot Studio: A Starter Guide to Building Your Own AI Agent
Resources
- IDN Homograph Attack explanation: Wikipedia
- Palo Alto Networks Unit 42: The Homograph Illusion
- Bitdefender: Homograph Phishing Attacks
- Huntress: What Is Punycode? A Cybersecurity Guide
- Guardio: Cyrillic Scams and Homograph Attacks
- CaptainDNS: How to Spot a Phishing Email in 2026
The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.
