Published: May 15, 2022 on our newsletter Security Fraud News & Alerts Newsletter.
Not the easiest word to pronounce or spell, homoglyph attacks continue to be widely used by fraudsters intent on stealing your PII (personally identifiable information). Homoglyphs use characters in a domain name that look like what they’re supposed to be, but they’re not. Cybercriminals use characters from English and other languages to create sneaky, but fake domain name spellings, all with the goal of stealing your PII from a bogus website. Homoglyph fakes may not be easy to spot, especially for users who aren’t aware these attacks exist. A domain name fake can be as easy as one letter different or one letter that looks similar in that URL bar, such as “Gooqle.com” instead of “Google.com.” Hackers count on users not noticing the homoglyph in order to be successful, and now these attacks are easier to pull-off than ever before.
Homoglyph exploit kits were recently discovered for sale on the web, making it easy for lone actors to engineer these attacks. For the sum of $1,300, aspiring and established cybercriminals can purchase these kits that help make stealing payment and other PII a snap. Security experts also discovered there’s a new exploit in town using the homoglyph technique for credit card skimming hacks. Bad actors monitor their homoglyph websites, waiting for unsuspecting users to input their payment information into fake purchase forms. From there, it’s easy for hackers to steal a user’s credit card number and other coveted PII on these fake forms.
Keeping a homoglyph from succeeding takes attention to detail and a desire not to be ripped-off. One helpful tip is to bookmark what you know is the true and trusted website, entirely avoiding any homoglyph tricks. Never follow links to websites or open attachments, especially if the source isn’t known or trusted. That also includes those links found in emails, on social media posts, or online advertising. These links are easy to manipulate using homoglyphs and can show up where you least expect them. Instead, it’s safer to input the address manually, being sure you’re not making typos, as those can catch out unsuspecting users too. As always when online, be prepared for the unexpected and pay close attention to detail.
Keep up to date: Sign up for our Fraud alerts and Updates newsletter
Want to schedule a conversation? Please email us at advisor@nadicent.com