‘Right-to-Left Override’ Aids Email Attacks
Summary: Attackers are abusing the Unicode right-to-left override character (U+202e) to disguise executable files as harmless documents, such as a file named CORP_INVOICE_08.14.2011_Pr.phyldoc.exe that displays as CORP_INVOICE_08.14.2011_Pr.phylexe.doc. According to Commtouch, this technique is being used in an unusually aggressive series of spam blasts ongoing since mid-August, with outbreaks sometimes occurring three times per day rather than the 2010 average of every 10-14 days.
What you should know: The spam carries password-stealing bots including SpyEye and Zbot/ZeuS, and many mail applications cannot reliably scan the zip archives these files arrive in, so a user trained to avoid .exe files can still be fooled by a filename that ends in .doc.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026