Invisible Malicious Unicode Risks
Donate
This wiki page explains the security risk of invisible characters in Unicode that can be copied and pasted into terminal emulators or introduced as vulnerabilities/backdoors in source code contributions, along with documentation that can help to check files and folders for malicious Unicode.
OOPS! They tricked me to install MALWARE! Clipboard Hidden Text Attacks explained
Unicode as a Security Risk[edit]
There are invisible characters that might be copied that can do malicious actions. This is a security risk for:
- A) For users: Commands copied and pasted into a terminal emulator.
- B) For developers: Introduction of invisible vulnerabilities or backdoors through source code contributions.
These adversarial encodings produce no visual artifacts probably in most editors and terminals.
Note: Not all unicode in files is necessarily malicious. Only some unicode characters in some files are suspicious or potentially malicious.
Original attack research:
https://trojansource.codes/
Forum discussion:
https://forums.whonix.org/t/detecting-malicious-unicode-in-source-code-and-pull-requests/13754
Searching Files and Folders for Unicode[edit]
unicode-show[edit]
grep-find-unicode-wrapper[edit]
grep-find-unicode-wrapper [1] can help to check files for unicode.
Syntax for files:
grep-find-unicode-wrapper /path/to/filename
Example for files:
Note: The following example check file ~/.bashrc. Replace ~/.bashrc with the actual file to check.
grep-find-unicode-wrapper ~/.bashrc
Syntax for folders:
grep-find-unicode-wrapper -r /path/to/folder
Example for folders:
Note: The following example check the user's home folder. Replace ~/ with a different folder if another folder should be checked.
grep-find-unicode-wrapper -r ~/
Expected output:
- A) If no unicode has been found: None.
- B) If unicode has been found: All lines that include unicode.
Expected exit codes:
- A) If no unicode has been found: non-zero exit code.
- B) If unicode has been found: Exit code
0.
Similarity with grep:
Since grep-find-unicode-wrapper is a wrapper around grep, output and exit codes are similar to grep.
Resources[edit]
- gcc protects from this https://www.phoronix.com/news/GCC-LLVM-Trojan-Source but other compilers and script interpreters don't even have bug reports.
- "31m"?! ANSI Terminal security in 2023 and finding 10 CVEs
- https://www.bleepingcomputer.com/news/security/phishing-attack-hides-javascript-using-invisible-unicode-trick
- https://x.com/aemkei/status/1843756978147078286
- https://embracethered.com/blog/posts/2024/terminal-dillmas-prompt-injection-ansi-sequences/
- https://stacklok.com/blog/silent-but-deadly-how-minders-new-rules-can-help-detect-and-prevent-homoglyph-attacks-in-your-code
- https://github.com/reinderien/mimic
- https://github.com/reinderien/mimic/wiki/Implications
- https://unix.stackexchange.com/questions/73713/how-safe-is-it-to-cat-an-arbitrary-file
- https://unix.stackexchange.com/questions/15101/how-to-avoid-escape-sequence-attacks-in-terminals
- https://www.youtube.com/watch?v=3T2Al3jdY38
- https://daniel.haxx.se/blog/2025/05/16/detecting-malicious-unicode/
See Also[edit]
Footnotes[edit]
A secure by default operating system with the latest security research in place.
At
Kicksecure we value freedom and trust, supporting Open Source and Freedom Software
2012-
2025 ENCRYPTED SUPPORT LLC
We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!