BiDi Swap: The bidirectional text trick that makes fake URLs look real
Source Reddit InfoSec News
Description
The BiDi Swap phishing technique exploits the bidirectional text rendering feature in Unicode to craft URLs that visually appear legitimate but actually direct users to malicious sites. By inserting special Unicode control characters, attackers can reverse portions of the URL text, making fake domains look real to users and evade detection. This trick is particularly dangerous in phishing attacks where users rely on visual inspection of URLs to verify authenticity. European organizations are at risk due to widespread use of browsers and email clients that support bidirectional text rendering. The threat can lead to credential theft, malware infection, and data breaches. Mitigation requires user awareness, URL parsing improvements in security tools, and disabling or flagging suspicious bidirectional characters in URLs. Countries with high internet usage, significant financial sectors, and advanced digital infrastructure, such as Germany, the UK, France, and the Netherlands, are more likely to be targeted. Given the ease of exploitation and potential for significant impact on confidentiality and integrity without user authentication, this threat is assessed as high severity. Defenders should prioritize detection of BiDi characters in URLs and educate users about this phishing technique.