Executare_silita_anвђ®fdp.exe

The is a special invisible character (Unicode U+202E ) used in coding to reverse the order of the characters that follow it. Here is how the trick happened:

In reality, the file Elena saw was a lie. The true name of the file on the server was executare_silita_an[RTLO]fdp.exe .

It began scanning her browser for saved passwords and banking cookies. executare_silita_an‮fdp.exe

Elena was worried. She knew she was up to date on her taxes, but the name "pdf" at the end of the file gave her a sense of security. She clicked "Download." The Optical Illusion: The RTLO Trick

Here is a story of how this digital "Trojan Horse" works its way onto a computer. The Decoy: A Letter from the Tax Man The is a special invisible character (Unicode U+202E

The attacker named the file executare_silita_an followed by the RTLO character. They then typed fdp.exe .

If you hover your mouse over a file in some email clients, it may reveal the true, non-reversed name. It began scanning her browser for saved passwords

In Windows, always check "File name extensions" in the View tab of your folder. A real PDF will end in .pdf , but a trick file might show up as .pdf.exe .