Homoglyph Attack

A homoglyph attack uses characters from different alphabets that look nearly identical in a browser or interface. The technique is especially effective in domains because a user can see what appears to be a trusted name while the underlying registration points to an attacker-controlled site.

Expanded Definition

A homoglyph attack is a deception technique that exploits visually confusable characters, often by mixing scripts such as Latin, Cyrillic, or Greek so that a name, URL, or account identifier appears legitimate at a glance. In identity and cyber operations, the danger is not merely the lookalike string itself but the trust decision it triggers in a browser, email client, registry, or approval workflow. The attack is commonly discussed alongside typosquatting and brand impersonation, but it is more specific because the malicious identifier may be technically valid and visually convincing rather than simply misspelled. Standards and vendor guidance vary in how they classify the risk, but the practical security concern is consistent: human reviewers and automated allowlists can both be fooled when they rely on visual inspection alone. NIST control language on access and identification is useful context, and the same problem is frequently observed in phishing, credential theft, and impersonation scenarios. The most common misapplication is treating it as a simple typo problem, which occurs when defenders only monitor obvious misspellings and ignore script mixing or Unicode confusables.

Examples and Use Cases

Implementing defences against homoglyph abuse rigorously often introduces filtering and review friction, requiring organisations to weigh user convenience against the risk of visual impersonation.

Homoglyph attacks show up in several practical settings where trust is built from a name rather than a cryptographic check.

• Phishing domains that substitute a visually similar character in a login URL so the victim believes the site is the real service.
• Lookalike sender names or display names in email and chat platforms, where the interface shows a trusted brand but the underlying account is different.
• False software package names or repository identities that mimic a popular project and lure developers into installing malicious code.
• Impersonation of internal users or service accounts in ticketing and collaboration systems, especially when reviewers approve requests quickly.
• Brand protection workflows that compare candidate registrations against known names and must account for Unicode confusables, not just exact matches.

For threat modelling, the technique maps well to real-world phishing and impersonation tradecraft described in the MITRE ATT&CK Enterprise Matrix, although ATT&CK focuses on adversary behaviour rather than the naming problem itself. It also matters when organisations assess emerging AI-enabled social engineering, including the scenarios discussed in the Anthropic report on AI-orchestrated cyber espionage.

Why It Matters for Security Teams

Homoglyph attacks matter because they undermine the assumptions behind user trust, policy enforcement, and machine-assisted review. Security teams that only validate exact strings can miss malicious identities that are visually indistinguishable from approved ones, which weakens anti-phishing controls, domain governance, software supply chain checks, and administrative approvals. The issue is especially important where people make fast trust decisions from a browser tab, a directory entry, or an email header, because the attacker benefits from context collapse: the recipient sees a familiar name and stops checking the underlying identifier. For identity and NHI teams, the lesson extends to service principals, API endpoints, and agentic workflows, where a misread identifier can lead to token theft, unsafe delegation, or unauthorised tool access. Control baselines in NIST SP 800-53 Rev 5 Security and Privacy Controls support stronger identification and monitoring expectations, but the operational challenge is to pair those controls with Unicode-aware validation and review. Organisations typically encounter the impact only after a phishing click, fraudulent approval, or impersonation incident, at which point homoglyph attack handling becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Why does Agentic AI make NHI attack surface expand so significantly?
• What is the difference between attack surface management and NHI governance?
• Why do NHIs create a larger attack surface than human users?
• Why do static scanners miss some cloud-native attack paths?