Not hypothetical. Each earned a CVE or a name and changed how tools behave; some are in active real-world use, others are researcher disclosures with no confirmed in-the-wild abuse. Each case says which.
Seen in the wild
Homoglyph domains - a padlock on the wrong site
A registrable look-alike: аpple.com begins with U+0430 CYRILLIC SMALL
LETTER A, not Latin a. It is a different domain that can hold its own valid TLS certificate and
padlock. Xudong Zheng's 2017 proof-of-concept registered a Cyrillic apple.com that Chrome and
Firefox then displayed indistinguishably from the real one.
The fix: Chrome, Safari and Edge now show the punycode form (xn--...) for
confusable domains, though Firefox still renders whole-script Cyrillic look-alikes by default; registrars also restrict mixed-script registrations. The same trick still
works on package names and command names, which have no such guard.
Seen in the wild: homoglyph domains are an active phishing technique --
xudongz.com - Phishing with Unicode Domains.
Proof of concept
Trojan Source - a backdoor your eyes cannot see
2021, CVE-2021-42574 (bidi) and CVE-2021-42694 (homoglyph), Boucher & Anderson at Cambridge.
Bidirectional-override characters placed in source comments and strings reorder how code
displays without changing how the compiler reads it. A reviewer sees an early
return or a harmless comment; the compiler sees logic that ships a backdoor. It hit nearly
every compiler and language at once, because the deception lives in the text layer, below the language.
The fix: compilers and linters now warn on bidi controls in source; GitHub shows a
warning banner on affected files and GitLab highlights the characters inline. Catch it before merge with unicode-show and
check-ref-commits-for-unicode.
Proof of concept: research disclosure with no documented in-the-wild source-code use --
trojansource.codes
(CVE-2021-42574, CVE-2021-42694).
Proof of concept
Pastejacking - you copied one command, you ran another
2016, Dylan Ayrey. A command shown on a web page is copied, but a JavaScript copy handler
(or CSS-hidden text, or a trailing newline) places something else on your clipboard. Paste it into
an unprotected terminal and a hidden trailing newline runs it before you can read it.
The fix: paste into an editor first, never straight into a shell; enable bracketed
paste so a pasted newline cannot auto-execute; and treat every "copy" button as untrusted. There is a live,
safe demonstration on the Paste page.
Proof of concept: a 2016 research demonstration; its in-the-wild social-engineering
cousin "ClickFix" is on the Paste page --
github.com/dxa4481/Pastejacking.