Phishing Campaign Exploits Japanese Character “ん” to Imitate Forward Slash

Cybercriminals are getting more creative with their tricks—this time by exploiting the Japanese katakana character “ん” (U+3093) to imitate a forward slash ( / ) in phishing URLs.

What’s Happening

Researchers have observed a new phishing technique where attackers replace legitimate slashes ( / ) in URLs with the Japanese character “ん.” While this character looks visually similar in certain fonts and screen resolutions, it leads to a completely different domain name.

For example:

• Legitimate link: https://secure-login.com/account/login
• Malicious imitation: https:んsecure-login.comんaccountんlogin

At a glance, unsuspecting users may not notice the subtle character swap, making it an effective social engineering tactic.

Why It’s Dangerous

• Bypasses casual inspection: Many users skim links before clicking, and the similarity is enough to trick the eye.
• Avoids standard URL filters: Traditional filters may not immediately flag these links since they technically don’t contain real forward slashes.
• Expands phishing surface: This method can be combined with brand impersonation (banks, cloud services, e-commerce) to lure victims.

Who Is at Risk

• Email & SMS recipients: Links delivered through messages are the prime targets.
• Corporate employees: Companies with less strict link monitoring may be vulnerable.
• Non-technical users: Individuals unfamiliar with internationalized domain name (IDN) attacks are more easily deceived.

How to Stay Protected

1. Inspect links carefully – Copy and paste into a text editor with clear fonts.
2. Enable advanced email filtering – Modern security gateways can flag suspicious Unicode characters.
3. Educate users – Awareness training can help employees spot unusual URLs.
4. Use trusted bookmarks – Access banking and enterprise apps through saved bookmarks, not links in emails.
5. Deploy browser security features – Enable anti-phishing and Unicode domain warnings in browsers.

CyberGuard Insight

This attack is part of a growing trend of Unicode-based phishing where attackers abuse lookalike characters from different languages (homoglyph attacks). As digital communication becomes increasingly global, these subtle tricks are likely to spread.

Organizations should update security awareness programs and include examples of non-Latin character phishing in training.

🔐 Stay alert. Stay secure.
Follow CyberGuard Bulletin for the latest updates on evolving phishing tactics.