New characters allow lookalike domains to fool browsers

What happened

Researchers have identified new characters that can be used by malicious actors to create domain names that appear legitimate in web browsers, potentially leading to phishing (messages that impersonate someone to obtain passwords or money) and credential theft. Threat Intelligence New characters allow lookalike domains to fool browsers October 11, 2026 Share By SC Staff (Adobe Stock) Following insights from The Register, researchers have identified new characters that can be used by malicious actors to create domain names that appear legitimate in web browsers, potentially leading to phishing and credential theft.

These characters visually resemble standard Latin letters 'e', 'o', and 'k', allowing attackers to register domain names that look identical to legitimate ones when displayed in Unicode, despite appearing as different Punycode when rendered correctly. For example, 'аррӏө.com' appears as 'apple.com' to unsuspecting users.

These bypasses exploit weaknesses in Chromium's SafeToDisplayAsUnicode and GetSimilarTopDomain functions. The former has a hardcoded list of known Cyrillic characters, and if a character is not on this list, the check can be bypassed.