Reduce this risk by detecting deceptive filenames and scripts that use bidirectional text control characters to hide the real extension or execution intent. Configure email, file, and code review tools to flag such characters, and train users to inspect file types carefully. Block or sanitise suspicious filename patterns where possible.
How Right-to-Left Override abuse works
Right-to-Left Override abuse relies on bidirectional text control characters that change how a filename or script is rendered, so the visible name does not match the real extension or execution intent. The practical risk is not the character itself, but the mismatch it creates between what users see and what the system will open, run, or inspect.
Attackers use this to disguise executable content, hide a dangerous double extension, or make a script look like a document or image. The abuse is most effective where the display layer trusts the rendered string more than the underlying filename, especially in mail clients, file browsers, chat tools, and review workflows.
Defence depends on making the hidden characters visible or unusable. That means treating filename rendering as a security control, not just a user-interface detail, and checking whether downstream tools preserve the same string a user is actually being shown.
Which mitigations reduce the abuse path
The strongest mitigation is to detect and flag filenames or source text that contain bidirectional control characters, then surface the full underlying name before the user acts on it. Email gateways, file upload filters, endpoint tools, and code review systems should all inspect the raw string rather than the rendered appearance.
Where the workflow allows it, block suspicious filename patterns outright, or sanitise them by removing control characters before storage, display, or transfer. That is especially useful for attachments, downloaded archives, source bundles, and scripts that may later be copied into execution paths. Malware Guide is a useful companion when the deceptive filename is part of a broader delivery or execution chain.
User awareness still matters because these attacks exploit visual trust. Train people to check the actual file type, not just the name shown in the interface, and to be suspicious of names that appear truncated, reversed, or inconsistent with the icon, extension, or source of the file. That is particularly important in support inboxes, code reviews, and shared file repositories.
Where the control can fail in practice
These mitigations fail when the security layer scans only for malware signatures but does not inspect text direction controls, or when one tool sanitises names while another preserves the original string. A file can look harmless in one product and still carry the original deceptive name into a later step.
Failure mechanism: the attacker inserts bidirectional control characters into a filename or script label, causing the visible text to render in a misleading order while the underlying extension or execution intent remains dangerous.
Impact: users and reviewers may approve, open, or execute content they would have rejected if the real filename were visible, increasing the chance of malware delivery, script execution, or mistaken trust.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-8 — Audit Log Management | Logging and alerting help detect deceptive filenames and suspicious file handling. |
| Recommendation — Log file submissions and flag names containing bidirectional control characters. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Input validation applies to sanitising filenames and blocking unsafe text patterns. |
| SI-3 — Malicious Code Protection | Controls that inspect file content and attachments support detection of disguised malicious files. | |
| Recommendation — Validate and sanitise filenames before storage, display, or execution. Scan attachments and downloads for suspicious naming and content anomalies. | ||
| ISO/IEC 27001:2022 | A.8.12 — Data leakage prevention | Preventive filtering can block deceptive file names from reaching users or downstream systems. |
| Recommendation — Filter or normalise suspicious filenames before they are shared or executed. | ||
| MITRE ATT&CK | T1036 — Masquerading | Right-to-left override abuse is a masquerading technique that hides true file intent. |
| Recommendation — Hunt for masquerading files that use Unicode controls to disguise extension or purpose. | ||
Practitioner Guidance
What to verify: Confirm that mail, endpoint, repository, and upload controls inspect the raw filename string, not only the rendered text. Test with known bidirectional control characters and verify that the user sees a warning, blocked upload, or clearly normalised name.
What good looks like: The organisation can consistently show the true extension and preserve evidence of the original submission, while preventing deceptive names from reaching users in a trusted form. In review systems, the reviewer should see the same risky string that the control layer evaluated.
Decision rule: If a file name contains directionality controls and the file type or execution intent is ambiguous, treat it as suspicious until it is normalised and revalidated. If the content is user-submitted or externally sourced, prefer blocking or quarantine over silent correction.
Practitioner takeaway: Do not rely on visual inspection alone, because the attack succeeds by making humans and tools disagree about what the filename actually says.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org