The campaign makes use of what’s called percentage-based URL encoding – a basic URL-encoding technique in which normal ASCII characters (i.e., “abc” and “123”) are converted into a ...

New phishing campaigns attempt to evade detection by constructing rogue QR codes with special ASCII characters and load phishing pages locally using the local blob URL feature in browsers.

That's because some of the code points found in the latter look-alike URL are invisible to the user by design. The difference can be easily discerned by using any Unicode encoder/decoder, such as ...