Visual Spoofing via RTL Override, Punycode, and Homoglyph Injection
Attackers can hide malicious instructions or fake URLs inside text that looks harmless by using invisible right-to-left override characters, Punycode-encoded domains, or letters from other alphabets (Cyrillic, CJK) that look like normal Latin letters. This tricks both human reviewers and AI systems into trusting or executing content that isn't what it appears to be.
How the attack works
An attacker crafts text containing Unicode tricks: RTL override characters that reverse how text displays so a malicious filename or command looks safe, Punycode-encoded domain names that render as trusted brand names but resolve to attacker-controlled sites, or homoglyphs (visually identical characters from Cyrillic or CJK scripts) substituted into words or URLs to evade keyword filters. This crafted text is delivered to an AI agent, often embedded in a document, message, or webpage the agent processes. If the agent trusts the visual appearance of the text rather than its underlying encoding, it may follow injected instructions or treat a spoofed domain as legitimate. The goal is to bypass both human visual inspection and automated content filters simultaneously.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9c5626f5-d995-4a22-83ea-dbc773047b62
- Severity
- High
Why it matters
An organization can have its AI agent tricked into visiting attacker-controlled domains, executing disguised commands, or leaking data, all while the malicious content looks benign to anyone reviewing it visually.
What you can do
- →Normalize and strip bidirectional control characters (RTL/LTR overrides) before displaying or processing untrusted text.
- →Decode Punycode domains and flag or block any that mix scripts with well-known brand names.
- →Run homoglyph detection on text before it reaches decision-making logic, especially on domains, filenames, and command strings.
- →Review flagged content manually, keeping in mind that legitimate Cyrillic, CJK, or RTL text and technical IDN documentation will also trigger these checks.
Known benign look-alikes
- Legitimate content in Cyrillic, CJK, or RTL scripts
- Academic papers or linguistics research containing examples of Cyrillic-Latin character comparisons in educational context
- Software documentation discussing internationalized domain name (IDN) encoding with Punycode examples in technical specifications
- Chinese/Japanese technical documentation that places a unified CJK ideograph directly beside a Latin token (for example a Markdown or API term embedded in a Chinese sentence) - normal bilingual writing, which is why condition 4 is scoped to CJK COMPATIBILITY ideographs only