In a paper released by two (2) University of Cambridge researchers, a new technique has been released that allows threat actors to embed vulnerabilities in source code that appear visually correct to human reviewers. Dubbed “Trojan Source”, this technique relies on the appearance of certain Unicode characters, called “bidirectional control characters”, in the modified source code. Threat actors can use this to conduct three (3) unique attacks outlined by the researchers: Early Returns, which causes a function to end early. Commenting-Out causes a comment to appear as legitimate code but does not run when executed. And lastly Stretched Strings, which allows strings to appear as code while not running when executed, similar to Commenting-Out. Using these Trojan Source techniques, an attacker can, for example, return a function before it subtracts money from their bank account, stealing funds from a bank. There is also a variant to this attack, which uses homoglyphs, or characters that appear similar, in function names and calls. The researchers also have created a GitHub repository with examples of vulnerable code in multiple languages. Following the release of this technique, GitHub has created an alert that informs users when bidirectional Unicode text appears in a file. The researchers urge programming language developers and developer security operation pipelines to include checks for these characters and alert the user when they are present.