Homograph phishing (noun) [Word Notes]

Summary

---

Podcast Summary: Hacking Humans – "Homograph Phishing (noun) [Word Notes]"

Date: December 9, 2025
Podcast: Hacking Humans
Host: N2K Networks
Episode Theme: Deception, influence, and social engineering in the world of cybercrime, focusing on the concept of "homograph phishing."

---

Overview

This episode of "Word Notes" explores homograph phishing, a sophisticated social engineering technique where deceptive websites use visually similar characters to legitimate sites, tricking users into divulging sensitive information. The host breaks down the technical and social mechanisms behind this phishing style, its real-world examples, and why it's more challenging—but sometimes still feasible—for attackers.

---

Key Discussion Points and Insights

What is Homograph Phishing?

• [01:23-02:02]
  • Homograph phishing is introduced as a cybersecurity term involving the manipulation of characters in URLs to deceive users into trusting fake sites.
  • Definition quote:

    "The use of similar looking characters in a phishing URL to spoof a legitimate site."
    — Host [01:50]

Example and Mechanism

• [02:02-02:17]
  • Example provided:

    "The attacker used a homograph phishing attack to fool the victim into visiting a spoofed version of a banking site."

  • Emphasizes how subtle changes in a URL—often visible only on close inspection—can redirect users to malicious destinations.

Technical Origin and Context

• [02:17-04:14]

  • Homograph attacks leverage the Unicode standard, which allows thousands of characters across languages, versus the limited ASCII character set.

  • Classic example of basic attacks: replacing 'o' with '0' (typosquatting).

  • Homograph attacks become sophisticated when indistinguishable characters from different alphabets are substituted. For instance, Latin "o" vs. Cyrillic "o" look identical, but carry different underlying code.

  • Martin Zugig (Bitdefender) Quote [Referenced by Host]:

    "Homograph attacks use international domain names to insert characters from different languages... Each URL will lead to a different site."

  • Such attacks require more effort (custom domain registration) and are rarer, as most browsers now display ASCII-based hostnames, making Unicode domain names less useful for attackers.

    "IDN homograph attacks are not common. They require custom domain registration, and most browsers don't use the display name anymore, like Unicode. Instead, they will use the real name ASCII code." — Host summarizing Zugig [03:40]

  • Still, they remain a "viable option for the highly motivated threat actor."

Cultural Analogy – "Mission Impossible"

• [04:14-05:11]
  • Pop culture reference:
    The host draws a parallel to the "Mission Impossible" franchise, where IMF agents use rubber face masks to impersonate others—much like characters in URLs are swapped in homograph attacks.

    "These masks are the spy's homographs. They make the IMF members look similar in an uncanny Valley kind of way... which then allows them to fish information from the targets because they are unguarded around these seemingly well known friends." — Host [04:30]

---

Notable Quotes & Memorable Moments

• "The use of similar looking characters in a phishing URL to spoof a legitimate site." — Host [01:50]
• "The attacker used a homograph phishing attack to fool the victim into visiting a spoofed version of a banking site." — Host [02:02]
• "The Latin letter o and the Cyrillic letter o appear the same to the human eye but have different underlying Unicode." — Host referencing Zugig [03:15]
• "IDN homograph attacks are not common... but it is a viable option for the highly motivated threat actor." — Host [03:55]
• "These masks are the spy's homographs... which then allows them to fish information from the targets because they are unguarded around these seemingly well known friends." — Host [04:35]

---

Important Timestamps

• [01:23] — Introduction of the term "homograph phishing"
• [01:50] — Formal definition and example use case
• [02:17] — Deep dive: Technical context and Unicode explanation
• [03:15] — Notable example: Latin vs. Cyrillic "o"
• [03:40] — Analysis of attack feasibility and browser defenses
• [04:14] — "Mission Impossible" analogy for social engineering parallels

---

Conclusion

The episode leaves listeners with a concise, accessible understanding of homograph phishing, its technical underpinnings, how it differs from basic typo-squatting, and why it's more typical of advanced attackers. The "Mission Impossible" analogy drives home how subtle impersonation—be it in facial features or URL characters—can undermine trust and enable deception, a core theme in the social engineering playbook.

---

Transcript

[A]

You're listening to the Cyberwire Network powered by N2K.

[B]

Most environments trust far more than they should, and attackers know it. ThreatLocker solves that by enforcing default deny at the point of execution. With ThreatLocker allow listing, you stop unknown executables cold. With ring fencing, you control how trusted applications behave, and with threatlocker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero trust principles without the operational pain. It's powerful protection that gives CISOs real visibility, real control, and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose ThreatLocker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your [e-mail] N2K today.

[C]

The word is homograph fishing.

Spelled homograph, as in words that are spelled the same but have different meanings, and phishing, as in a social engineering technique that tricks the user into thinking that they are interacting with a trusted entity.

Definition the use of similar looking characters in a phishing URL to spoof a legitimate site.

Example sentence the attacker used a homograph phishing attack to fool the victim into visiting a spoofed version of a banking site.

Origin and Context Unicode is an encoding standard used to display text on a computer. Unlike ASCII, which uses eight bits per character and only can represent 128 or 256 symbols, Unicode can display more than 144,000 characters. This allows Unicode to display text in many different languages. Homograph or homoglyph phishing attacks use similar looking Unicode characters to craft deceptive phishing URLs. In most instances, these discrepancies can be spotted if the user looks closely, such such as when the attacker replaces the letter o with the number zero. These simple attacks are usually referred to as typo squatting. In some cases, however, the characters can appear identical. Martin Zugig of Bitdefender explains that these homograph attacks use international domain names to insert characters from different languages into the URL. For example, the Latin letter o and the Cyrillic letter o appear the same to the human eye but but have different underlying Unicode. Therefore, a URL that uses the Latino can look exactly the same as the one that uses the Sirilico, but each URL will lead to a different site. Zugik notes that homographic attacks based on international domain names require much more effort than typo squatting, but they're still achievable by sophisticated attackers. Zugik says IDN homograph attacks are not common. They require custom domain registration, and most browsers don't use the display name anymore, like Unicode. Instead, they will use the real name ASCII code. While this makes it impractical for most attackers, it is a viable option for the highly motivated threat actor.

Nerd Reference the impossible franchise, a TV show that ran from 1966 to 1973 and and the Tom Cruise movie collection, with six movies under his belt from 1996 to 2018. And as of this writing, Cruise is filming the next two is famous for creating rubber face masks for its Impossible Mission Force or IMF team members. These masks are the spy's homographs. They make the IMF members look similar in an uncanny Valley kind of way, to colleagues and conspirators of their intelligence targets, which then allows them to fish information from the targets because they are unguarded around these seemingly well known friends.

Wordnotes is written by Tim Nodar, executive produced by Peter Kilping, and edited by John Petrick and me, Rick Howard. The mixed sound, design and original music have all been crafted by the ridiculously talented Elliot Peltzman. Thanks for listening.

[B]

AI is transforming every industry, but it's also creating new risks that traditional frameworks can't keep up with. Assessments today are fragmented, overlapping, and often specific to industries, geographies or regulations. That's why Black kite created the BKGA3AI assessment framework to give cybersecurity and risk teams a unified, evolving standard for measuring AI risk across their own organizations and their vendors. AI use it's global, research driven, built to evolve with the threat landscape, and free to use. Because Blockchain Black Kite is committed to strengthening the entire cybersecurity community. Learn [e-mail].