A website address can look legitimate even when it contains characters designed to impersonate a trusted domain.
Security researchers Ian Muscat and Leanne Briffa of Have I Been Squatted have identified two weaknesses in Chromium's handling of internationalized domain names. The issues involve the Cyrillic character ө and the Latin character ƙ, which can help certain lookalike domains evade browser checks intended to detect deceptive addresses.
Their analysis of .com domains found approximately 162,000 potentially confusing .com domain pairs, according to The Register. While these are not confirmed phishing websites, the findings show how attackers could exploit visually similar characters to impersonate trusted services and potentially steal credentials.
How two characters bypass Chromium's domain checks
Homograph attacks exploit characters from different writing systems that look similar to familiar letters. Attackers can use them to register domains that appear nearly identical to legitimate websites. This technique is known as a homograph attack.
Researchers at Have I Been Squatted have identified two non-conventional web address characters that exploit weaknesses in how browsers detect deceptive domain names. The characters in question are the Cyrillic ө and the Latin ƙ.
The researchers’ findings show how these characters can create lookalike domains.
The first weakness involves SafeToDisplayAsUnicode(). The researchers found that ө was missing from a list of confusable characters, allowing certain deceptive domains to pass a check intended to prevent misleading displays.
The second weakness affects GetSimilarTopDomains(), which compares a domain’s normalized character representation, known as a skeleton, against popular website names to identify potential impersonation.
According to the researchers, ƙ (read as k with a hook) escapes this detection during the comparison, allowing lookalike domains with the letter ƙ to be passed off as the normal k.
The researchers demonstrated the technique using lookalike domains resembling Apple, SpaceX, Okta, and Nike. The addresses contain characters that appear similar to familiar Latin letters but have different underlying Unicode values.
- aррӏө[.]com
- sрасөх[.]com
- oƙta[.]com
- niƙe[.]com
Why Chromium's existing checks may miss these domains
Most users rely on their browsers to spot suspicious websites, especially those designed to resemble legitimate ones through a homograph attack. When those safeguards don't work as intended, users may assume a website is safe when they're actually walking into trouble.
The researchers showed that these weaknesses affected the tested Chromium environment, including Chrome 154 — Google Chrome’s latest version at the time of research. This highlights a limitation of software updates: they can address known vulnerabilities and improve existing protections, but a newly discovered bypass can still work until it is patched.
That means individuals relying on their browsers may fall victim to phishing if an attacker combines a convincing UI and UX with a homograph domain.
For businesses, it creates a similar problem, but in this case, employees entering corporate credentials into convincing imitations of business applications can lead to a much larger problem.
Here is how to stay safe
The findings reinforce why users should not rely solely on how a website address looks when deciding whether to trust it.
Opening sensitive websites through saved bookmarks or trusted applications can reduce exposure to deceptive links. Password managers can also help because they generally match saved credentials to specific domains rather than relying on visual similarity.
- Even though they can’t guarantee protection against every new spoofing technique, keeping your browsers up to date remains an important defense mechanism.
- Avoid clicking unexpected login links in emails, text messages, or social media posts. This is especially relevant here because in the researchers’ demo, both Gmail and Outlook also failed to apply the checks against the lookalike websites properly.
- Type in the actual URL yourself, even though it’s inconvenient.
- If a website address or UI looks unusual, asks you to sign in unexpectedly, or redirects you to an unfamiliar destination, stop and verify the address again, or check whether official documentation supports that kind of activity.
- Enable multi-factor authentication on important accounts, preferably using passkeys where available, which offers stronger protection against phishing.
Businesses should also monitor for domains impersonating their brands and consider registering high-risk variations where practical. Security awareness training can help employees recognize suspicious login requests, although visual inspection alone is not a reliable defense against sophisticated homograph attacks.
The researchers' findings show that even established browser protections can miss certain deceptive addresses. Until the affected checks are addressed, users and organizations should treat familiar-looking domains as only one signal of a website's legitimacy.
Other news: Security researchers have uncovered P7 DarkSword, a new iPhone spyware variant capable of stealing Apple Keychain credentials, cryptocurrency wallet data, and other sensitive information.