Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1027.018sub-technique of T1027 Obfuscated Files or Information

Invisible Unicode

Linux · macOS · Windowsnothing on this site yetT1027.018 on attack.mitre.org

Adversaries may abuse invisible or non-printing Unicode characters to conceal malicious content within files, scripts, or text. By inserting characters that do not visibly render, adversaries may hide data, alter how content is interpreted, or make malicious code appear as benign text or whitespace.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for Invisible Unicode

  • Detection identifies execution of scripts or files that appear visually benign (low printable character ratio) but result in runtime decoding, dynamic evaluation, and subsequent process or network activity.
  • Detection identifies execution of scripts containing high concentrations of invisible Unicode characters followed by decoding or interpretation behaviors (e.g., base64 decode, eval) and subsequent process or network activity. Emphasis is placed on mismatch between file entropy/structure and execution output.
  • Detection identifies execution of scripts or applications containing invisible Unicode payloads reconstructed at runtime, correlated with abnormal AppleScript, JavaScript for Automation, or shell execution and subsequent process or network behavior inconsistent with visible file content.

the rest of T1027

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.