A homoglyph attack is a spoofing technique that uses characters that look almost identical to trusted letters, numbers, or symbols. Attackers mix scripts such as Latin and Cyrillic, or swap in visually similar Unicode characters, to create names that appear legitimate at a glance but point to an attacker-controlled resource.
This matters because security decisions are often made from what users see in a browser, email, or chat client. A convincing lookalike domain can bypass casual inspection and make phishing links, fake login pages, or malicious downloads seem safe. Defenders reduce the risk by displaying suspicious internationalized domains in punycode, flagging mixed-script names, using exact-origin checks in password managers, and training users to verify more than visual appearance. In practice, homoglyph attacks are a social-engineering problem made possible by how software renders text.