Threat reportPhishingTL-2026-3353
New IDN Domain Spoofing Techniques (Breaker Characters and Diacritic Handling) Bypass Chromium Lookalike Phishing Protections
New IDN Domain Spoofing Techniques (Breaker Characters and (TL-2026-3353), also tracked as Turning IDN Edge Cases into Typosquats, is a medium-severity phishing campaign, first published 2026-10-12. It has no confirmed attribution, affects Google Chrome (Chromium IDN lookalike checks), references 3 CVEs (CVE-2019-13659, CVE-2019-13663, CVE-2019-13674), maps to 8 MITRE ATT&CK techniques (T1036, T1204.001, T1566), and is covered by 9 detection rules and 21 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 21Indicators of compromise
Key facts for TL-2026-3353
- Threat ID
- TL-2026-3353
- Also known as
- Turning IDN Edge Cases into Typosquats
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, finance, government administration, health, cybersecurity, gaming, news - media, energy
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 21
How New IDN Domain Spoofing Techniques (Breaker Characters and works
Have I Been Squatted researchers Ian Muscat and Leanne Briffa published two internationalized domain name (IDN) edge cases that evade Chromium's Unicode lookalike safeguards: 'breaker' characters absent from the lookalike lists, and diacritic handling that leaves combining marks in the skeleton so it no longer matches the legitimate domain. 20 proof-of-concept .com domains were registered; Chrome 154 on macOS and Gmail Web displayed the lookalikes in Unicode.
Chromium decides whether to show an IDN hostname in Unicode or as Punycode (A-label) through a two-stage check. Stage 1, SafeToDisplayAsUnicode(), runs seven validation steps per label, including whole-script confusable checks. Stage 2, GetSimilarTopDomain(), compares the hostname's skeleton against about 8,462 bundled top domains. The skeleton computation removes diacritics, generates variants for ambiguous characters and maps confusables to ASCII.
Technique 1 is substitution with 'breaker' characters. Characters such as U+04E9 (ө, resembles o/e), U+04AF (ү, resembles y) and U+0457 (ї, resembles i) are allowed by Chromium but missing from its Cyrillic lookalike lists. A label made of Cyrillic lookalikes plus one breaker passes the whole-script confusable check and is shown in Unicode. The researchers registered domains such as аррӏө.com (apple.com, Punycode xn--80a6aa68c8d.com), орөпаі.com (openai.com), ѕкурө.com (skype.com) and каѕрөгѕку.com (kaspersky.com). Two further breakers, U+048F (ҏ) and U+04FF (ӿ), are already rejected from Chrome 148 onward.
Technique 2 is diacritic handling. Chromium strips diacritics before applying confusable mappings. Accented characters such as ó and é are removed entirely and match the target exactly. Characters with hooks or strokes, such as ƙ, map to a Latin letter plus a combining mark, so the skeleton keeps the mark and sits one or two edits from the legitimate domain. This evades skeleton matching. Examples are oƙta.com (okta.com), niƙe.com (nike.com), sƙy.com (sky.com), vƙ.com (vk.com) and ƙicƙstarter.com (kickstarter.com).
Testing showed Chrome 154 on macOS and Gmail Web rendering the lookalikes in Unicode (Gmail showed all 20 sender domains that way). Outlook Web showed the encoded A-labels. No CVE, CVSS score, threat-actor attribution or in-the-wild exploitation is reported. The reporting says it does not demonstrate a bypass of all phishing defenses, and reputation checks, allowlists, spam filtering and link scanning were not evaluated. The risk is that attackers use the same technique to register convincing brand-impersonation domains for credential phishing and business email compromise.
MITRE ATT&CK techniques used in TL-2026-3353
Defense Evasion
T1036 Masquerading; T1684.001 Impersonation
Execution
Initial Access
T1566 Phishing; T1566.002 Spearphishing Link
Resource Development
Reconnaissance
T1598 Phishing for Information; T1598.003 Spearphishing Link
Affected products and versions in New IDN Domain Spoofing Techniques (Breaker Characters and
Remediation for New IDN Domain Spoofing Techniques (Breaker Characters and
Patches
- No vendor patch or CVE issued as of the reporting; Chromium already rejects ҏ (U+048F) and ӿ (U+04FF) from Chrome 148
Immediate actions
- Monitor newly registered xn-- (IDN) domains within two edits of protected brand domains, including the .com zone file
- Enable email gateway impersonation and lookalike-domain protection
- Treat xn-- domains as an infrastructure signal in DNS and proxy telemetry
Workarounds
- Block or warn on non-ASCII hostnames at the secure web gateway for users with no business need
- Show Punycode (A-label) forms for external sender domains in mail clients where configurable
Longer-term hardening
- Deploy FIDO2/passkeys so phished credentials cannot be replayed on a lookalike site
- Register lookalike spellings that survive skeleton comparison and directly protect short domains (4 characters or fewer)
- Apply IDN-aware DNS and proxy policies
CVEs associated with New IDN Domain Spoofing Techniques (Breaker Characters and
Weaknesses (CWE) in New IDN Domain Spoofing Techniques (Breaker Characters and
Timeline of New IDN Domain Spoofing Techniques (Breaker Characters and
- Xudong Zheng publishes the all-Cyrillic apple.com Punycode homograph PoC, prompting Chrome's whole-script-confusable protections (introduced in Chrome 58)
- Chrome 58 ships the whole-script-confusable lookalike protection referenced in the Have I Been Squatted research
- Chrome 77 fixes several Omnibox IDN-spoofing CVEs (e.g. CVE-2019-13659, CVE-2019-13663, CVE-2019-13674), showing the recurring nature of IDN lookalike bypasses
- Chrome 148 (released May 2026, exact day not stated in source) upgrades to ICU 78.2 / Unicode 17.0, which moves U+048F (ҏ) and U+04FF (ӿ) to Uncommon_Use so Chromium rejects them; the two breaker characters are closed reactively
- Testing shows Gmail Web displays all 20 PoC sender domains in Unicode while Outlook Web shows A-labels; Chrome 154 renders аррӏө.com in Unicode; Chrome 155 is reported to ship a 28-character Cyrillic lookalike list
- Research reports the October 2026 .com zone file holds 167.2M delegated names, 733,509 xn-- IDN names and 161,894 lookalike pairs, of which 102,592 exact-match pairs display as Unicode
- Have I Been Squatted publishes 'Turning IDN Edge Cases into Typosquats' describing breaker-character and diacritic bypasses with 20 registered PoC .com domains
- GBHackers reports the research; Chrome 154 on macOS and Gmail Web render the PoC domains in Unicode while Outlook Web shows A-labels
Sources cited for New IDN Domain Spoofing Techniques (Breaker Characters and
- Researchers Discover New Domain Spoofing Techniques That Bypass Chrome's Phishing Protections
- Turning IDN Edge Cases into Typosquats - Have I Been Squatted
- CVE-2019-13659 - Chrome Omnibox IDN spoofing (prior art)
- CVE-2019-13663 - Chrome Omnibox IDN spoofing (prior art)
- CVE-2019-13674 - Chrome Omnibox IDN spoofing (prior art)
- Internationalized Domain Names (IDN) in Google Chrome - Chromium docs
Detection coverage for TL-2026-3353
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3353 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.