TLDR Tech / InfoSec
Sender spoofing in Proton Mail via display-name homograph
A vulnerability in Proton Mail's web interface allows for sender spoofing, where a forged sender appears identical to a legitimate one. Attackers achieve this by using a display name that contains an address-shaped string, such as 'sundar@gmaiI[.]com', where a capital 'I' is visually indistinguishable from a lowercase 'l' in the default UI font. Messages from domains lacking DMARC arrive in the inbox without an authentication banner. A 'Reply-To' header can redirect responses to an attacker’s address, remaining hidden unless the user expands headers. The spoofed sender also persists in macOS desktop notifications. The issue, reported in February 2025 and awarded a bounty in April 2025, remains reproducible as of September 2026.
Read the full story