Researchers show Cyrillic domain can evade Chromium lookalike checks

Researchers at Have I Been Squatted demonstrated a Cyrillic domain that evades Chromium's safeguards against addresses resembling legitimate websites, Tom's Hardware reports. The example resembles apple.com but uses a character outside Chromium's list of 29 Cyrillic characters commonly used to imitate Latin letters. Chromium normally exposes suspicious addresses by displaying their encoded Punycode form. The all-Cyrillic example passes checks that reject mixed alphabets and familiar lookalike combinations. HIBS recommends passkeys, which bind authentication to a specific domain and prevent users from logging into an impersonating site with those credentials.