Executive Summary
In early 2024, cybersecurity researchers uncovered a wave of phishing campaigns leveraging the 'BiDi Swap' technique, where attackers exploit bidirectional Unicode text in URLs to mask malicious domains as legitimate ones. By inserting special control characters, cybercriminals create deceptive links that appear authentic to end-users and some security tools, increasing the risk of credential thefts and unauthorized access, especially for organizations relying on standard phishing defenses. The attack exploits a decade-old browser flaw now resurfacing with renewed sophistication.
This incident highlights a dangerous resurgence of invisible text manipulation tactics, which are rapidly proliferating across phishing kits and social engineering toolkits. As workforces rely on web-based authentication and email, organizations should urgently review their detection capabilities to spot Unicode obfuscation and mitigate emerging URL-based threats.
Why This Matters Now
The BiDi Swap technique is trending in phishing attacks because it bypasses standard domain reputation checks and user awareness, making traditional safeguards less effective. Its easy adoption by attackers and limited visibility across major platforms create an urgent need for proactive URL inspection and employee training.
Attack Path Analysis
The attack began when users were tricked into clicking phishing links disguised by the BiDi Swap text trick, leading to credential theft via fake login portals. The attackers then leveraged stolen credentials to escalate privileges within cloud accounts. Gaining access, they moved laterally to identify valuable assets and services. The adversary established command and control by maintaining covert outbound connections, preparing for data theft. Sensitive data was exfiltrated via encrypted channels or direct downloads. Finally, attackers could use access for business disruption or extortion.
Kill Chain Progression
Initial Compromise
Description
Users were targeted with phishing emails containing BiDi Swap-manipulated URLs that mimicked trusted domains, resulting in credential theft.
Related CVEs
CVE-2016-5163
CVSS 4.3The bidirectional-text implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not ensure left-to-right (LTR) rendering of URLs, allowing remote attackers to spoof the address bar via crafted right-to-left (RTL) Unicode text.
Affected Products:
Google Chrome – < 53.0.2785.89
Exploit Status:
no public exploitReferences:
CVE-2014-8146
CVSS 7.5The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C before 55.1 does not properly track directionally isolated pieces of text, allowing remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via crafted text.
Affected Products:
Apple Mac OS X – <= 10.10.4
Apple iTunes – <= 12.1.3
Exploit Status:
no public exploitCVE-2021-22567
CVSS 5.3Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors, which can be exploited to get nefarious code passed a code review by appearing benign.
Affected Products:
Google Dart SDK – < 2.15.0
Exploit Status:
no public exploitCVE-2017-5449
CVSS 6.5A possibly exploitable crash triggered during layout and manipulation of bidirectional Unicode text in concert with CSS animations.
Affected Products:
Mozilla Firefox – < 53
Mozilla Firefox ESR – < 52.1
Mozilla Thunderbird – < 52.1
Exploit Status:
no public exploitCVE-2015-5883
CVSS 5The bidirectional text-display and text-selection implementations in Terminal in Apple OS X before 10.11 interpret directional override formatting characters differently, allowing remote attackers to spoof the content of a text document via a crafted character sequence.
Affected Products:
Apple Mac OS X – <= 10.10.5
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Phishing
User Execution
Trusted Relationship
Subvert Trust Controls: Code Signing
Masquerading
Brute Force
Gather Victim Identity Information
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – User Training and Awareness
Control ID: 5.4.1
NYDFS 23 NYCRR 500 – Cybersecurity Program
Control ID: 500.02
DORA – ICT Risk Management Framework
Control ID: Article 10
CISA ZTMM 2.0 – Continuous Threat Monitoring
Control ID: 3.1.2
NIS2 Directive – Measures for Managing Risks Posed by Supply Chains
Control ID: Article 21(2)(d)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Banking/Mortgage
BiDi Swap phishing attacks exploit bidirectional text vulnerabilities to create convincing fake banking URLs, bypassing traditional security controls and threatening financial data integrity.
Financial Services
Sophisticated URL spoofing through bidirectional text manipulation targets financial institutions, compromising client trust and enabling credential harvesting for unauthorized account access.
Information Technology/IT
IT organizations face elevated risks from BiDi Swap techniques that circumvent URL filtering and detection systems, requiring enhanced security controls and user awareness training.
Computer/Network Security
Security firms must address this decade-old browser vulnerability resurgence, updating threat detection capabilities and developing countermeasures against bidirectional text-based phishing campaigns.
Sources
- BiDi Swap: The bidirectional text trick that makes fake URLs look realhttps://www.bleepingcomputer.com/news/security/bidi-swap-the-bidirectional-text-trick-that-makes-fake-urls-look-real/Verified
- BiDi Swap: A Decade-Old Unicode Flaw Still Enables URL Spoofinghttps://securityonline.info/bidi-swap-a-decade-old-unicode-flaw-still-enables-url-spoofing/Verified
- Bidirectional characters warning in Atlassian productshttps://support.atlassian.com/atlassian-knowledge-base/kb/bidirectional-characters-warning-in-atlassian-products/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
CNSF and Zero Trust controls including network segmentation, egress policy enforcement, and threat detection would significantly disrupt the phishing kill chain by isolating workloads, reducing lateral movement, and blocking suspicious outbound activities. Centralized, real-time visibility and strong policy enforcement would help detect anomalous behavior and prevent data exfiltration.
Control: Threat Detection & Anomaly Response
Mitigation: Detects anomalous login or web traffic behavior indicative of phishing.
Control: Zero Trust Segmentation
Mitigation: Limits attacker movement even with valid credentials by enforcing least privilege.
Control: East-West Traffic Security
Mitigation: Blocks unauthorized workload and service-to-service communication.
Control: Cloud Firewall (ACF) & Inline IPS (Suricata)
Mitigation: Detects and blocks malicious or unauthorized outbound communications.
Control: Egress Security & Policy Enforcement
Mitigation: Prevents or alerts on unapproved data exfiltration attempts.
Provides early detection of abnormal actions preventing or limiting overall business impact.
Impact at a Glance
Affected Business Functions
- User Authentication
- Web Browsing
- Email Communication
Estimated downtime: 3 days
Estimated loss: $500,000
Potential exposure of user credentials and sensitive information due to successful phishing attacks leveraging bidirectional text vulnerabilities.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce strict workload-to-workload segmentation and least-privilege access using identity-driven zero trust policies.
- • Deploy centralized egress controls and FQDN filtering at the cloud perimeter to block malicious outbound activity and exfiltration attempts.
- • Continuously monitor for phishing and credential-theft indicators with behavioral anomaly detection and threat intelligence feeds.
- • Use distributed inline inspection (firewall and IPS) across cloud and hybrid environments to disrupt C2 channels and packet-borne threats.
- • Maintain centralized visibility and automate response workflows to quickly identify, contain, and remediate unauthorized access or lateral movement.
