Detect right-to-left override by scanning file names, archive contents, and messages for bidirectional text control characters that make dangerous extensions appear benign. Compare the displayed name with the true underlying character order, and block or quarantine files that use invisible direction controls to disguise executables, scripts, or archives.
What security teams should look for in file and message content
Right-to-left override is usually detected by looking for a mismatch between what a user interface displays and the true byte or character sequence underneath it. Security tooling should inspect file names, archive entries, and message bodies for bidirectional control characters, especially when an apparently harmless extension is followed by text that would read differently under Unicode rendering rules.
The practical challenge is that the dangerous part is often not the visible name itself, but the way the name is rendered after an invisible direction control changes the reading order. That is why detection should compare the display form against the normalized underlying string, then flag cases where a control character causes the apparent extension, suffix, or label to differ from the real one.
Where this matters most is in attachments, downloads, shared archives, and any workflow that relies on filename-based trust decisions. A file that looks like a document may actually be executable content, and a similar trick can be used in tickets, chat messages, or email subjects to create misleading context for a human reviewer or a parser.
How to validate suspicious names safely
Good detection starts with normalization and inspection, not just visual review. Teams should decode filenames and message text into a canonical form, surface non-printing Unicode characters, and then evaluate whether a bidirectional override changes the apparent extension or ordering of dangerous terms. If the rendered result and the actual character sequence do not match, treat the item as suspicious.
For archive handling, check both the top-level archive name and the names of embedded files before extraction. Right-to-left override can hide inside nested content, so scanning only the outer filename is not enough. The safest workflow is to examine metadata, preserve the raw string for logging, and compare it to the sanitized display string used by user-facing tools.
Detection is strongest when it is paired with policy enforcement. Security controls should block or quarantine files that contain invisible direction controls in places where they can disguise executable, script, or archive types, and should preserve the original name for investigation rather than rewriting it silently.
Why this issue is easy to miss in day-to-day operations
Right-to-left override succeeds because it exploits a gap between character storage and human perception. Many mail clients, chat platforms, file browsers, and security queues render names in a way that is helpful for normal text but dangerous when a control character changes the reading direction. That means manual review alone is unreliable unless analysts know exactly what to inspect.
It also shows up in places where teams assume the file type is obvious from the ending string. If a control character makes the extension appear reversed or shifted, the visible name may no longer tell the truth. The risk is not limited to malware delivery, because the same technique can be used to hide scripts, nested archives, or deceptive document labels that trigger a mistaken trust decision.
Risk and Threat Considerations
Bidirectional text abuse is a low-effort deception technique that can defeat casual review, especially in environments that rely on filename cues for triage or allow users to trust what they see on screen. The main risk is misclassification, where a dangerous file is treated as benign long enough to be opened, extracted, or forwarded.
Failure mechanism: An attacker inserts an invisible direction control into a filename or message so the displayed extension or label is rendered out of order, creating a false impression of safety while the underlying object remains executable or otherwise dangerous.
Impact: Users or security workflows may approve, open, or distribute a malicious file based on a misleading display name, increasing the chance of code execution, payload delivery, or further propagation through internal review paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-09 — Malicious Code Detection | Detecting disguised executable content through monitoring supports malware detection. |
| PR.DS-01 — Data-at-Rest Protection | Quarantining suspicious files protects stored content from unsafe handling. | |
| PR.PS-01 — Configuration Management | Normalizing and validating file handling behavior reduces UI deception risk. | |
| Recommendation — Inspect filenames and attachments for deceptive control characters in detection workflows. Quarantine disguised files before they can be opened or extracted. Apply consistent filename normalization across security tools and user-facing systems. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Preserving raw names and inspection results supports investigation of deceptive filenames. |
| Recommendation — Log the raw and rendered filename forms for review and incident response. | ||
| MITRE ATT&CK | T1036 — Masquerading | Right-to-left override is a classic masquerading technique that makes files look benign. |
| Recommendation — Map deceptive filename cases to masquerading detections and hunt for disguised extensions. | ||
Practitioner Guidance
What to verify: Confirm that your mail, endpoint, and file inspection layers expose the raw character sequence, not only the rendered name. A control is working when analysts can see both the displayed string and the underlying order, and when suspicious direction controls are surfaced consistently across tools.
Decision rule: If a filename or message contains bidirectional control characters and the apparent extension no longer matches the actual character order, treat it as hostile until proven otherwise. Quarantine the item, preserve the original artifact for analysis, and avoid relying on visual inspection as the final check.
Practitioner takeaway: The key test is not whether the name looks odd, but whether rendering changes what the object appears to be. Detection should therefore be based on canonical text inspection plus policy enforcement, because human eyeballing is exactly what this trick is designed to defeat.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org