RTLO Override (Right-to-Left Override Attack)
What is RTLO Override (Right-to-Left Override Attack)?
RTLO Override (Right-to-Left Override Attack)A filename and string obfuscation technique that inserts the U+202E Unicode right-to-left override character to flip the rendered order of characters, masking executables as PDFs, images, or docs.
The RTLO attack abuses the Unicode bidirectional algorithm by inserting U+202E (RIGHT-TO-LEFT OVERRIDE) into a filename or string. From that point on, characters are rendered right-to-left until a paragraph break, so `invoice_U+202Efdp.exe` is displayed in Explorer, mail clients, and chat apps as `invoice_exe.pdf`. The file is still an executable — the operating system uses the raw byte order — but the user sees what looks like a harmless document. Variants substitute other bidi-control characters (U+200E, U+200F, U+2066-U+2069) and have been weaponized in phishing campaigns since at least 2011; the same family of tricks underlies the 2021 'Trojan Source' research (Boucher & Anderson) showing that BiDi controls in source code can hide back-doored logic from human reviewers while compilers see something different. Mitigations include stripping or visualizing BiDi controls in any UI that displays untrusted filenames, refusing to execute files containing control characters in their names, and linters that warn on BiDi characters inside source code.
● Examples
- 01
A phishing email attaches `vacation_photo_U+202Efdp.scr` which Outlook renders as `vacation_photo_rcs.pdf` until the user double-clicks it.
- 02
A static analyzer added a check after the 2021 'Trojan Source' paper to fail builds containing unbalanced BiDi control characters in source files.
● Frequently asked questions
What is RTLO Override (Right-to-Left Override Attack)?
A filename and string obfuscation technique that inserts the U+202E Unicode right-to-left override character to flip the rendered order of characters, masking executables as PDFs, images, or docs. It belongs to the Attacks & Threats category of cybersecurity.
What does RTLO Override (Right-to-Left Override Attack) mean?
A filename and string obfuscation technique that inserts the U+202E Unicode right-to-left override character to flip the rendered order of characters, masking executables as PDFs, images, or docs.
How does RTLO Override (Right-to-Left Override Attack) work?
The RTLO attack abuses the Unicode bidirectional algorithm by inserting U+202E (RIGHT-TO-LEFT OVERRIDE) into a filename or string. From that point on, characters are rendered right-to-left until a paragraph break, so `invoice_U+202Efdp.exe` is displayed in Explorer, mail clients, and chat apps as `invoice_exe.pdf`. The file is still an executable — the operating system uses the raw byte order — but the user sees what looks like a harmless document. Variants substitute other bidi-control characters (U+200E, U+200F, U+2066-U+2069) and have been weaponized in phishing campaigns since at least 2011; the same family of tricks underlies the 2021 'Trojan Source' research (Boucher & Anderson) showing that BiDi controls in source code can hide back-doored logic from human reviewers while compilers see something different. Mitigations include stripping or visualizing BiDi controls in any UI that displays untrusted filenames, refusing to execute files containing control characters in their names, and linters that warn on BiDi characters inside source code.
How do you defend against RTLO Override (Right-to-Left Override Attack)?
Defences for RTLO Override (Right-to-Left Override Attack) typically combine technical controls and operational practices, as detailed in the full definition above.
What are other names for RTLO Override (Right-to-Left Override Attack)?
Common alternative names include: U+202E attack, Right-to-left override, Trojan Source filename.
● Related terms
- attacks№ 917
Phishing
A social-engineering attack in which an attacker impersonates a trusted party to trick a victim into revealing credentials, transferring money, or running malware.
- attacks№ 1182
Social Engineering
The psychological manipulation of people into performing actions or disclosing confidential information that benefits an attacker.
- malware№ 1299
Trojan Horse
Malware that disguises itself as a legitimate program to trick users into running it, delivering a hidden malicious payload.
- attacks№ 1191
Spear Phishing
A targeted phishing attack tailored to a specific individual or organization using personal or professional details collected in advance.
- attacks№ 536
Homograph Attack (IDN Homograph)
A phishing technique that registers a domain using Unicode characters visually identical to ASCII ones — Cyrillic 'а' for Latin 'a', Greek omicron for Latin 'o' — so the attacker URL is indistinguishable from the legitimate one to the eye.
- malware№ 399
Dropper
Malware whose role is to install ("drop") another malicious payload onto a target system, often after evading initial detection.