Phishing Attack Uses Known Domain URLs
As you know it’s always a good idea to never follow any links on pages or in email messages that you don’t trust 100%. Best practice is to always open a new browser window or tab and manually type the address in the address bar. That couldn’t be more important now with the phishing attack that uses unicode to register domains that look identical to real domains. The fake domains look exactly like the real domain URL in the address bar and can fool users into signing into a fake website which then gives the login details to an attacker.
Firefox fix:
In your firefox location bar, type ‘about:config’ without quotes.
Do a search for ‘punycode’ without quotes.
You will see a message that “This might void your warranty” and an “I accept the risk” button – click that.
You should see a parameter titled: network.IDN_show_
Change the value from false to true. ( double click that line )
Chrome fix:
Chrome is said to have a release coming out – if it’s not already. I believe this extension should work too – or search for Punycode alert in the Chrome extension store.
Until you have a fix on your browser if you are on a site and want to make sure it’s the real site before you login or submit sensitive information, you can copy the URL in the location bar and paste it into Notepad or TextEdit on Mac.
Read more info on the Wordfence.com site’s blog – here