Researchers said to defend against such attacks, compilers, interpreters, and build pipelines supporting Unicode should throw errors or warnings for unterminated bidirectional control characters in comments or string literals, and for identifiers with mixed-script confusable characters.

This attack variant is tracked as CVE-2021-42694. “An attacker can define such homoglyph functions in an upstream package imported into the global namespace of the target, which they then call from the victim code,” said researchers.

There is also a variant that uses homoglyphs, which are characters that appear nearly identical to letters. Lastly, there are “Stretched Strings.” These cause portions of string literals to visually appear as code, which has the same effect as commenting-out and causes string comparisons to fail. The second is “Commenting-Out.” This causes a comment to visually appear as code, which in turn is not executed. The first technique is called “Early Returns.” This causes a function to short circuit by executing a return statement that visually appears to be within a comment. Hackers can use multiple techniques to exploit the visual reordering of source code tokens, according to researchers. They added that compilers and interpreters adhere to the logical ordering of source code, not the visual order. “These visually reordered tokens can be used to display logic that, while semantically correct, diverges from the logic presented by the logical ordering of source code tokens,” said researchers. Researchers said the attack exploits subtleties in text-encoding standards, such as Unicode, to produce source code with logically encoded tokens that are in a different order from how they are displayed, leading to vulnerabilities.

BlackRock banking Trojan targets Android apps.

Android users told to be on high alert after Cerberus banking Trojan leaks to the dark web.

Hackers use open source Microsoft dev platform to deliver trojans.

Android Trojan charges millions of victims €36 per month.

Mass effect 2 hacking