Hackers Abuse RTL/LTR Text Tricks and Browser Flaws to Mask Malicious Links

Cybersecurity researchers at Varonis Threat Labs have uncovered a persistent vulnerability that has remained unaddressed for over a decade, allowing attackers to exploit browser handling of Right-to-Left and Left-to-Right text scripts to create deceptive URLs. This BiDi Swap technique enables threat actors to craft malicious links that appear legitimate to users, making it an effective tool for phishing campaigns.

The attack can combine Hebrew or Arabic characters with English subdomains, producing lookalike URLs that trick users into visiting malicious domains, sometimes masquerading as familiar sites such as varonis[.]com. Current browser protections are uneven: Chrome offers limited “navigation suggestion for lookalike URLs”, Firefox highlights key domain components, and Edge has not implemented major changes, while the now-discontinued Arc browser showed how enhanced visual indicators can help.

Organisations and individuals are urged to educate users, hover over links to reveal destinations, and rely on stronger lookalike detections and email filtering to mitigate Unicode-based spoofing attempts.