Threat reportPhishingTL-2026-3351
Unicode Homoglyph IDN Lookalike Domains Bypass Chromium Detection for Phishing
Unicode Homoglyph IDN Lookalike Domains Bypass Chromium (TL-2026-3351) is a medium-severity phishing campaign, first published 2026-10-12. It has no confirmed attribution, affects Google / Chromium Chrome (Chromium IDN spoof checks), maps to 7 MITRE ATT&CK techniques (T1036.005, T1204.001, T1566), and is covered by 9 detection rules and 20 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-3351
- Threat ID
- TL-2026-3351
- Severity
- MEDIUM
- Status
- TRACKING
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software, cybersecurity, retail, news - media, gaming, legal and information services, human resources
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
How Unicode Homoglyph IDN Lookalike Domains Bypass Chromium works
Have I Been Squatted researchers showed that Cyrillic characters missing from Chromium's confusables list (e.g. ө U+04E9) and skeleton-matching weaknesses with hook/stroke characters (e.g. ƙ) allow registrable lookalike IDNs that Chrome 154 renders in Unicode rather than Punycode. This is proof-of-concept research; no in-the-wild campaign, CVE or threat actor is identified.
Ian Muscat and Leanne Briffa of Have I Been Squatted published research (blog dated 2026-10-03, covered by Cyber Security News on 2026-10-12) on how internationalized domain name (IDN) homograph protections in Chromium can be bypassed. Chromium decides whether to show a label in Unicode or Punycode (xn--) using whole-script confusable checks derived from Unicode Technical Standard 39 (UTS #39). The Cyrillic whole-script check is all-or-nothing: if even one Cyrillic character in a label is not on Chromium's list of Latin lookalikes, the label is not rejected. The researchers identified Cyrillic 'breakers' absent from the list - ө (U+04E9, resembles o/e), ү (U+04AF, resembles y) and ї (U+0457, resembles i) - which were allowed in Chrome 148+ testing, whereas ҏ (U+048F) and ӿ (U+04FF) were rejected in Chrome 148+ (Unicode 17).
A second weakness concerns skeleton matching against Chromium's bundled top-domain list. Characters such as Latin ƙ (k with hook) and Cyrillic ө (o with bar) are single code points; when diacritics are stripped during skeleton generation, hooks and strokes persist as combining marks, so the skeleton does not exactly equal the target's skeleton (e.g. oƙta.com ends up one edit away from okta.com rather than matching). Navigation warnings do not trigger for labels that are 2+ edits away or for short names (under 5 characters before the TLD). The resulting chain: display check stage 1 passes because of the breaker character, stage 2 skeleton comparison fails to match, and navigation warnings do not fire.
The researchers registered 20 proof-of-concept domains impersonating brands including Apple (аррӏө.com, xn--80a6aa68c8d.com), OpenAI, Skype, Shell, Xerox, Opera, Chess.com, Kaspersky, LexisNexis, Nexon, One.com, Paychex, Okta (oƙta.com), Nike, Sky, VK and Kickstarter; the news article additionally names SharePoint, Pinterest and SpaceX. Chrome 154 displayed the Unicode form. In email, Gmail Web displayed all 20 test sender domains in Unicode while Outlook Web displayed A-labels (Punycode) for all. Chrome 155+ added the Cyrillic character м to the lookalike list on 2026-09-11 (list grew from 28 to 29 characters).
Scale analysis of the October 2026 .com zone: 167,226,216 delegated names, 733,509 in xn-- form, and 161,894 visual lookalike pairs covering 133,953 ASCII domains (102,592 exact Unicode matches, 46,522 reverse-confusable Unicode displays, 12,780 reverse-confusable Punycode displays); some pairs may be defensive registrations. Chromium's bundled domain list holds 8,462 domains, 836 in the top-priority bucket. No CVE, CVSS score, exploitation in the wild or actor attribution is stated by the sources; severity is an analyst estimate.
MITRE ATT&CK techniques used in TL-2026-3351
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1684.001 Impersonation
Execution
Initial Access
T1566 Phishing; T1566.002 Spearphishing Link
Resource Development
Reconnaissance
Affected products and versions in Unicode Homoglyph IDN Lookalike Domains Bypass Chromium
- Google / Chromium — Chrome (Chromium IDN spoof checks)
Vulnerable versions: 154 (tested); 148 (breaker characters allowed)
Fixed in: 155+ adds м to the Cyrillic lookalike list only; no complete fix stated - Google — Gmail Web
Vulnerable versions: Displayed all 20 test sender domains in Unicode
Remediation for Unicode Homoglyph IDN Lookalike Domains Bypass Chromium
Patches
- Chromium added м to the Cyrillic lookalike list in Chrome 155+ (2026-09-11); no CVE or full fix is stated in the sources
Immediate actions
- Monitor newly registered xn-- domains within 2 edits of protected brand domains
- Block or log xn-- domains in DNS and proxy logs outside an allowlist
- Enable mail gateway lookalike/impersonation protection and tag xn-- senders
Workarounds
- Avoid signing in through links in unexpected messages; navigate to brands directly
- Display Punycode for IDN senders in mail clients where configurable
Longer-term hardening
- Register lookalike spellings using ө, ү and ƙ for brands, especially names of 4 characters or fewer
- Review certificate transparency logs for lookalike IDN certificates
- Adopt phishing-resistant MFA (FIDO2/passkeys) and password managers
Weaknesses (CWE) in Unicode Homoglyph IDN Lookalike Domains Bypass Chromium
Timeline of Unicode Homoglyph IDN Lookalike Domains Bypass Chromium
- Earlier IDN homograph research demonstrated the Cyrillic аррӏе.com spoof of apple.com against browsers including Firefox, Opera and Chrome (referenced as background in the Have I Been Squatted research).
- Chrome 58 introduced the Whole-Script Confusable (WSC) check in response to the 2017 аррӏе.com spoof; the all-or-nothing design of that check is the root of the 2026 bypass.
- Chrome 148 moved to ICU 78.2 / Unicode 17 (May 2026), marking ҏ (U+048F) and ӿ (U+04FF) as Uncommon_Use so they are rejected, leaving ө, ү and ї as effective WSC breakers.
- Chromium added the Cyrillic character м to its lookalike list (Chrome 155+), growing it from 28 to 29 characters.
- Researchers' analysis of the October 2026 .com zone found 733,509 IDNs among 167,226,216 delegated names and 161,894 visual lookalike pairs covering 133,953 ASCII domains.
- Ian Muscat and Leanne Briffa of Have I Been Squatted published 'Turning IDN edge cases into typosquats', documenting the Cyrillic breaker characters, skeleton-matching weakness and 20 test domains.
- Cyber Security News reported the research, noting Chrome 154 displayed the spoofed аррӏө.com in Unicode and Gmail Web displayed all 20 test senders in Unicode while Outlook Web showed A-labels.
Sources cited for Unicode Homoglyph IDN Lookalike Domains Bypass Chromium
- New Unicode Characters Let Attackers Create Convincing Lookalike Domains for Phishing
- Turning IDN edge cases into typosquats - Have I Been Squatted
- Unicode Technical Standard #39: Unicode Security Mechanisms
- Homoglyph Attacks & Domain Squatting: The Hidden Risk to Your Brand - Cloud Security Alliance
- Phishing with Unicode Domains, an attack almost impossible to detect
- Google Chrome to get warnings for lookalike URLs - Slashdot
- Homograph attacks still happening - The Register
Detection coverage for TL-2026-3351
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3351 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.