Invisible Unicode

{
  "id": "ATTACK:enterprise:T1027.018",
  "title": "Invisible Unicode",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1027/018",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--e9b75bb0-b5ec-42c8-b728-f4f424d9c39e",
  "external_id": "T1027.018",
  "domain": "enterprise",
  "created": "2026-04-22T19:18:41.169Z",
  "modified": "2026-05-12T15:12:00.723Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "GlassWorm - Unicode",
      "url": "https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace#heading-5"
    },
    {
      "source_name": "PUAs Unicode - Eriksen",
      "url": "https://www.aikido.dev/blog/youre-invited-delivering-malware-via-google-calendar-invites-and-puas"
    },
    {
      "source_name": "Invisible Prompt Injection - Trend Micro",
      "url": "https://www.trendmicro.com/en_us/research/25/a/invisible-prompt-injection-secure-ai.html"
    },
    {
      "source_name": "LLMs and Unicode - Medium",
      "url": "https://idanhabler.medium.com/hiding-in-plain-sight-weaponizing-invisible-unicode-to-attack-llms-f9033865ec10"
    },
    {
      "source_name": "Tycoon2FA - Unicode",
      "url": "https://www.levelblue.com/blogs/spiderlabs-blog/tycoon2fa-new-evasion-technique-for-2025"
    },
    {
      "source_name": "Unicode and Hidden Prompts - Perets",
      "url": "https://cycode.com/blog/invisible-code-hidden-prompts-unicode-attacks-sast/"
    },
    {
      "source_name": "Unicode - Veracode",
      "url": "https://www.veracode.com/blog/down-the-rabbit-hole-of-unicode-obfuscation/"
    }
  ]
}