Researchers demonstrated how attackers can register lookalike web domains using two specific Unicode characters that Chromium-based browsers may display as trustworthy, normal-looking URLs. This can make phishing and typosquatting sites appear legitimate to employees, increasing the chance they click and enter credentials or other sensitive information.
Researchers demonstrated that two specific Unicode characters, ө and ƙ, can be used to register lookalike domains that Chromium-based browsers may render as normal, human-readable text rather than the warning-style Punycode format typically used for suspicious international domain names. They registered and tested 20 lookalike domains, including ones resembling Apple, Okta, and Nike, to show how convincing these substitutions can look in a browser address bar.
Chromium relies on a hardcoded list of lookalike characters and a skeletonization process to detect domains that resemble real ones. The research found two separate weaknesses:
On top of this, browser "Safety Tips" warnings may not trigger at all when a domain has two or more character changes from the original, or when the domain is shorter than five characters. This means short, brand-adjacent domains like a four-character Okta lookalike can slip through unnoticed.
The inconsistency gets worse outside the browser address bar. Email clients handle these domains differently from one another: Gmail displayed all 20 test domains in their deceptive Unicode form, exactly as an attacker would want, while Outlook Web rendered them as Punycode, which looks clearly suspicious. This means the same malicious link could appear completely legitimate in one inbox and obviously fake in another, making user training inconsistent across tools.
Employees should treat visually normal-looking URLs with some skepticism, particularly when prompted to enter credentials, and should consider copying a suspicious link into a plain text field to check for a Punycode (xn--) prefix. Security teams should not rely solely on browser warnings, since short domains and multi-character substitutions can evade them, and should instead actively monitor for lookalike domain registrations tied to their brand and key vendors, including internationalized domain name variants.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Researchers highlighted two characters, ө and ƙ, which can be used to build lookalike domains that Chromium-based browsers may display as normal Unicode text instead of warning-style Punycode.
Chromium's safety checks can be bypassed when a domain uses a character outside its hardcoded lookalike list, when it has two or more changes from the real domain, or when the domain is fewer than five characters long.
Yes, email clients can be even less consistent than browsers. Gmail displayed test domains in Unicode as an attacker would want, while Outlook Web displayed them as Punycode.
Security teams should monitor for lookalike domain registrations of their brand and vendors, including internationalized domain names, and employees should be cautious of unexpected links even when a URL looks normal.
Imagine this email: “Please sign in at oƙta.com to continue.” Looks fine, right? That URL might not be Okta at all. Attackers are registering domains with sneaky Unicode letters like ө and ƙ. In Chromium browsers, oƙta.com or aррӏө.com can show up as totally normal-looking URLs, skipping the scary xn-- Punycode form and many Safety Tips. Here’s the nasty bit: very short domains like oƙta.com, or ones with several swapped letters like aррӏө.com, may not trigger browser Safety Tips at all. Gmail might show them as friendly Unicode, while another client shows scary xn-- Punycode for the exact same link. If a login link feels even slightly off, copy the URL into a text box and check if it turns into xn-- Punycode. If it does, close it and go to the site by typing the real address yourself.
Researchers say a real macOS malware campaign is using “ClickFix” social engineering to trick users into installing an infostealer called AmnesiaStealer. Victims are lured to a counterfeit GitHub download page that encourages them to copy/paste a Terminal command, which then downloads and runs the…
Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…
Researchers showed how an attacker could trick Microsoft Copilot into running a malicious prompt automatically just by getting a user to click a specially crafted link. The prompt can then make Copilot search connected accounts (like email and cloud storage) and send information to an external…
PortSwigger research shows how attackers can weaponize HTML/CSS inside emails to cross trust boundaries in webmail, including UI manipulation, token theft, and password theft. The paper highlights real-world weaknesses in email sanitization and gives concrete examples (including an Outlook…
Check Point reports that scammers are now impersonating ChatGPT/OpenAI in phishing campaigns, reflecting how mainstream the service has become. One documented example used a fake “ChatGPT Plus payment failure” notice that sent victims to a fraudulent payment page designed to capture full credit…
Check Point reports that OpenAI’s ChatGPT became a top-10 most impersonated brand in Q2 2026 phishing. One observed example used a fake “ChatGPT Plus payment failed” billing email to drive victims to a credit-card theft page. The report also notes other brand-impersonation scams using cloned stores…
