Invisible Text Trick Disguises Malware and Bypasses Security Filters

The Unicode character U+202E, also known as Right-To-Left-Override (RTLO) is a legitimate text-formatting control designed to support Arabic and Hebrew languages.

In the hands of attackers, it becomes a method that can be used to social engineer users into opening malware, or bypass email filters to deliver malicious payloads.

By default, file extensions are hidden on Windows, but some organizations show them, so that you can see what type of file extension it is before clicking on it.

If you receive a file called “invoice.exe” you’re unlikely to open it. This is where RTLO come in. By inserting the RTLO character in the filename, an attacker can reverse how it displays. The character is invisible and affects how the text displays.

Here’s an example:

An attacker renames a malicious .exe file and inserts the RTLO character:

document[U+202E]fdp.exe

This reverses all of the text after the character, including the file extension, and the character itself is invisible, so to the user who receives the file, it looks like:

documentexe.pdf

The file is still an .exe and it executes when double-clicked. Most users are trained to look for files that end in exe to indicate that they’re executables, and they might miss that the file type is still listed as an ‘Application’.

Ferocious Kitten, an Iranian APT group active since 2015, has been documented using RTLO attacks to target dissidents, activists, and minority groups within Iran. They would send malicious files via Telegram and messaging apps.

RTLO can also bypass keyword-based email filters designed to detect phishing and scam messages by hiding keywords from automated detection while keeping them visible to humans.

Email providers use keyword filters to block phishing attempts. Phrases like “verify your account,” “urgent action required,” and “confirm your password” are common triggers that get emails flagged or blocked. Attackers discovered they could use RTLO to evade these filters entirely.

Here’s the trick: instead of typing “verify” normally, an attacker reverses it to “yfirev” and adds the RTLO character at the beginning, so it looks like this:

‮yfirev

When you look at the source code on this page, you’ll see the character, and the text written backwards. Successful obfuscation!

The same technique also works on any platform with keyword-based content moderation, such as social media applications, messaging apps, etc.

You can safely test the RTLO technique on your own system to see how it works. This is for educational purposes only.

You can access the character through your operating system’s special character menu, or copy it directly from here: https://unicode-explorer.com/c/202E‮

1. Press Win + R and type charmap, then press Enter

2. Check “Advanced view” at the bottom

3. In “Search for:” type 202E and click Search

4. Select the RIGHT-TO-LEFT OVERRIDE character

5. Click “Select” then “Copy”

1. Press Cmd + Control + Space to open Character Viewer

2. Search for 202E in the search box

3. Double-click the RIGHT-TO-LEFT OVERRIDE character to copy it

To simulate an environment where security-conscious administrators have configured systems to show full filenames with extensions, enable this setting:

1. Open File Explorer

2. Click the “View” menu

3. Click “Show” and check “File name extensions”

1. Open Finder

2. Click Finder menu, then Settings

3. Click the “Advanced” tab

4. Check “Show all filename extensions”

1. Create a new text file and save it as ‘document.txt’

2. Right-click the file and select Rename

3. Type: document

4. Press Ctrl+V (Windows) or Cmd+V (Mac) to paste the RTLO character.

5. Type: fdp.txt

6. Press Enter to save the filename

The file will appear as documenttxt.pdf but is actually a .txt file. Check the file Type to confirm it’s still a text document.

Defending against RTLO attacks requires a multi-layered approach that balances security with usability.

The challenge is that U+202E cannot simply be removed or blocked because it’s essential for billions of users writing in right-to-left languages like Arabic, Hebrew, and Persian. This creates a permanent tension between linguistic accessibility and security.

The solution is to build smarter defenses that detect anomalous usage rather than blocking the character entirely. For example, RTLO appearing in Windows executable filenames has no legitimate use case and should always trigger an alert.

For individual users, the first line of defense is awareness and careful file inspection:

• Enable “Show file extensions” in Windows Explorer through the View menu so you can see the complete filename including the extension

• When you receive an unexpected file attachment, check the Type column in File Explorer, which will show “Application” for executable files regardless of how the filename appears

• Right-click suspicious files and select Properties to view the true file extension and other metadata

• Be particularly wary of files with unusual spacing, question marks, or small boxes in their names, as these often indicate invisible Unicode characters

For organizations, defense requires technical controls at multiple layers:

• Email gateways should be configured to strip RTLO characters from attachments and message bodies, or at minimum flag messages containing them for review

• Endpoint detection and response systems should alert when RTLO appears in executable filenames on workstations

• Security awareness training should include specific examples of RTLO attacks so employees know what to watch for

• File scanning and malware analysis tools should normalize Unicode before performing keyword analysis to prevent evasion

RTLO serves a legitimate purpose for multilingual communication and cannot be blocked entirely. Effective defenses focus on detecting anomalous usage, such as RTLO appearing in executable filenames or phishing emails, which have no legitimate use case.