Homoglyph attacks: the letters that aren't what they look like
Say an office manager — we'll call her Grace — gets an email that looks like it's from a supplier she trusts, pointing to a familiar-looking web address. Everything reads right. But one letter in that address isn't the letter it appears to be. It's a homoglyph: a character from another alphabet that looks identical.
Why your eyes can't help you
Unicode has thousands of characters that look like ordinary letters. A Cyrillic а (U+0430) is pixel-for-pixel the same as a Latin a. Swap one into a word, a name, or a link and it reads perfectly — but it isn't the same text. Attackers use this to fake brand names, spoof addresses, and slip past filters that are looking for the "real" spelling. You literally cannot see the difference.
Where they turn up
- Text pasted from the web, or generated by a tool.
- Documents crafted to look like they came from a trusted name.
- Anything where a word "looks right" but behaves oddly when you search for it.
How to catch — and remove — them
Since the whole point is that they're invisible to the eye, you need a tool that checks the actual character codes. Drop a text or code file into scrub: it flags every non-ASCII look-alike letter — Cyrillic, Greek, full-width — plus a "this word mixes scripts" warning that catches the spoof even when a specific look-alike is brand new. One click normalises them back to plain letters, leaving your real content intact.
And because new look-alikes appear over time, scrub's detection is kept current with signature updates — so a trick invented this year still trips a warning.
The short version
Some letters aren't letters. When text "looks right" but you want to be sure, check it — your eyes can't. Get scrub free and scan a file in seconds. (Related: invisible characters in text.)