Homoglyph Attacks: How Unicode Spoofing Targets Streamers

The Attack You Can't See Coming

In July 2024, a threat detection team at MeshSecurity intercepted a phishing email targeting Microsoft 365 users. On the surface, it looked completely legitimate — the sender appeared to be "Support Message Center," the subject line read "Microsoft365 Notification(s): you have 3 held messages," and the email body contained a button linking to what appeared to be a Microsoft Forms page. The entire chain — from the initial email through two legitimate Microsoft-hosted pages — eventually led to a convincing fake login portal that silently harvested credentials before redirecting victims to the real Microsoft website.

When the security team decoded the email headers, they found something remarkable. The "Support Message Center" in the From field was not written in Latin characters at all. It was "Suррогt Меѕѕаgе сеոtеr" — a string where most of the letters had been replaced with visually identical characters from the Cyrillic alphabet. The subject line was the same: "Mіcrоsоft365" with Cyrillic і, о, and о substituted for their Latin counterparts. At the time the attack was active, the final phishing domain was marked completely clean on VirusTotal. Every automated security filter had missed it because the characters, while visually identical to Latin letters, are technically different Unicode code points that no keyword filter was checking for.

This is a homoglyph attack — and it's one of the most effective phishing techniques in use today.

What Unicode Makes Possible

To understand why this works, you need to understand a little about how computers represent text. Unicode is the international standard for encoding characters from every writing system in the world. It contains over 140,000 characters covering Latin, Cyrillic, Greek, Arabic, Chinese, and dozens of other scripts. This is genuinely useful — it means the internet can handle text in any language.

The problem is that many characters from different scripts are visually indistinguishable. The Cyrillic letter "а" (Unicode code point U+0430) is pixel-for-pixel identical to the Latin letter "a" (U+0061) in most fonts. The Greek letter "ο" (U+03BF) looks exactly like the Latin "o" (U+006F). The Cyrillic "е" looks like the Latin "e." On a screen, your eye cannot tell the difference. But to a computer, to a URL parser, to an email filter, they are completely different characters.

This means an attacker can register a domain like "аmazon.com" — where the "а" is Cyrillic — that looks identical to "amazon.com" in every email client, browser, and social media platform that renders it as Unicode. The domain resolves to a completely different server. The attacker controls it. And most security tools will never flag it because they're looking for "amazon.com," not "аmazon.com."

The History of This Attack

Homoglyph attacks are not new. In 2000, attackers registered "PayPaI.com" — substituting a capital I for the lowercase l — and used it to steal PayPal credentials from users who couldn't distinguish the two characters in small text. In 2017, security researcher Xudong Zheng demonstrated that replacing every letter in "apple.com" with its Cyrillic equivalent produced a domain that bypassed Chrome's IDN (Internationalized Domain Name) filters entirely and rendered as "apple.com" in the browser address bar. That same year, attackers registered "adoḅe.com" — using a dotted b character — and used it to distribute the Betabot banking trojan through fake Flash update prompts.

The technique has only become more sophisticated since then. Modern homoglyph phishing campaigns, like the Microsoft 365 attack described above, chain multiple legitimate services together to make the attack harder to detect. The initial link goes to a real Microsoft Forms page. That page redirects to a real Dynamics.com page. Only the final destination is attacker-controlled. By the time a victim reaches the phishing page, they've passed through two legitimate Microsoft domains, which creates a false sense of security and makes URL-based detection nearly impossible.

Why Streamers and VTubers Are Specific Targets

For streamers and VTubers, homoglyph attacks present a particular risk because of the nature of the relationship between creators and their audiences. When someone with a large following receives a message that appears to come from Twitch, YouTube, Discord, or a sponsor, they're likely to act on it quickly — especially if it's framed as urgent ("your account will be suspended," "you have a pending payment," "action required").

Attackers also use homoglyphs to impersonate streamers themselves. A fake Discord account with a username that looks identical to yours — but contains a Cyrillic character in place of one Latin letter — can be used to scam your followers. The fake account messages your community members claiming to offer a giveaway, a collaboration opportunity, or a special role, and asks them to click a link or provide information. Because the username looks exactly like yours, many people won't question it.

This kind of impersonation attack is particularly insidious because it damages your reputation even though you did nothing wrong. Your followers get scammed by someone pretending to be you, and some of them will blame you for it.

How to Detect and Defend Against This

The most reliable defense against homoglyph attacks is a password manager. This sounds counterintuitive, but it's the most practical protection available. Password managers don't read URLs visually — they parse them technically. When you navigate to "аmazon.com" (Cyrillic а), your password manager will not autofill your Amazon credentials, because it knows the domain doesn't match. That failure to autofill is your warning that something is wrong.

For detecting homoglyph impersonation of your own accounts, the most effective tool is simply pasting suspicious usernames into a Unicode analyzer. The website at compart.com/en/unicode will show you the Unicode code point for each character in a string. If you paste in a username that looks like yours and see Cyrillic or Greek characters where you'd expect Latin ones, you've found a homoglyph impersonator.

Modern browsers offer partial protection. Chrome and Firefox will display the punycode representation of a mixed-script domain in the address bar — so "аррӏе.com" (all Cyrillic) would appear as "xn--80ak6aa92e.com." This is a meaningful warning, but it only applies to domains, not to usernames on social platforms or text in email subjects and bodies.

For your own brand protection, consider registering the most obvious homoglyph variants of your streaming name as usernames on major platforms. This doesn't prevent all impersonation, but it takes away the most obvious attack vectors. You should also make it a habit to verify any account that messages you claiming to be from a platform or a sponsor by checking the account's creation date, follower count, and posting history before engaging.

The broader lesson from the 2024 Microsoft 365 attack is that visual inspection is not sufficient. If an email or message is asking you to take an action — click a link, enter credentials, approve a payment — verify through a separate channel before acting. Go directly to the platform's website by typing the URL yourself rather than clicking the link. Call the company. Check the official social media account. The extra thirty seconds of verification is worth it.

Explore all PrivacyWarden guides