EvilFontTool

A font-based deception tool for red teaming, security research, and whatever else.

EvilFontTool hides machine-readable text inside a document that displays completely different text to a human reader. It does this using Evil Fonts — fonts that intentionally deceive the viewer by rendering a different letter than understood by a computer. By remapping font glyphs, the document's visible characters show humans one thing while terminals, AI systems, and clipboard copy paste see another.

Evil Font Demos/Labs !!DON'T MISS THIS!!

• View the Demos → Here

• View the Evil Font Labs → Here

The word docx demos do NOT work on mobile due to the way mobile phones render fonts.

---

Table of Contents

• Installation
• Usage Tips
• PDFs Woes Explained
• Usage
• Ethical Use & Disclaimer
• Staying Safe from Evil Fonts
• Contributing
• Help me somethings not working!

---

Installation

pip install evilfonttool

From source

git clone https://github.com/DoctorEww/EvilFontTool.git
cd EvilFontTool
pip install .

For development (editable install):

pip install -e .

Dependencies

Installed automatically via pip:

• fonttools — font parsing and manipulation
• brotli — WOFF2 compression (used by fonttools)
• python-docx — DOCX generation
• reportlab — PDF generation
• pdf2image — PDF-to-image conversion
• pdfminer.six — PDF text/layout extraction
• Pillow — image handling for the PDF pipeline

System requirements (not installed by pip — must be on your PATH):

• LibreOffice — required for the pdf command, which shells out to soffice --headless to convert DOCX to PDF. The pdf command is experimental on Windows and may not work as intended.
  • Ubuntu/Debian: sudo apt install libreoffice
  • macOS: brew install --cask libreoffice
  • Windows: download installer
• poppler-utils — required by pdf2image to render PDF pages for the pdf command
  • Ubuntu/Debian: sudo apt install poppler-utils
  • macOS: brew install poppler
  • Windows: poppler for Windows (add the Library\bin folder to path) Or see below.

Poppler install windows helper script

Install poppler into ~\Documents\poppler and add to path.

irm (irm https://api.github.com/repos/oschwartz10612/poppler-windows/releases/latest).assets[0].browser_download_url -OutFile ~\Documents\poppler.zip
Expand-Archive ~\Documents\poppler.zip ~\Documents\poppler -Force
$bin = (gci ~\Documents\poppler -Recurse -Filter pdftotext.exe)[0].DirectoryName
[Environment]::SetEnvironmentVariable('Path', [Environment]::GetEnvironmentVariable('Path','User') + ";$bin", 'User'); $env:Path += ";$bin"

---

Where can I find fonts to use?

• Ubuntu: /usr/share/fonts
• Windows: C:\Windows\Fonts
• https://fonts.google.com/
• The internet??

---

Usage Tips

• Generate fonts and pdf's on Linux. The pdf command is experimental on Windows and may not work as intended.
• The pdf command does not work on complex word documents ex. columns. Feel free to open an issue if theres a feature you really want it to support.
• To embed fonts, use doc --ttf-dir <ttffonts_dir> (EvilFontTool embeds them itself) or Word on Windows. LibreOffice's own "embed fonts" option does not work for Evil Fonts.

PDF's Woes Explained

The pdf command doesn't rely on Evil Fonts at all. It renders the DOCX to an image (so the visible page is a picture, not text), then draws the real computer text on top as fully invisible, selectable text. Copy-paste and text extraction read that invisible layer instead. There are a few other tools that can do this, but nothing as easy as the pdf command when you already have a DOCX you like.

If you want a genuine Evil Font PDF, you need to build the Word doc without invisible letters (invisible letters don't survive PDF conversion). From there, export directly from Word or use "Print to PDF." This keeps everything in a single layer, giving the document different IOCs than the well-known two-layer trick used by the pdf command. The pdf command exists purely because that manual process is tedious, and sometimes you just want a quick PDF copy of a Word doc.

TLDR;

• Option 1: (easy one) Use the pdf command → two-layer PDF, same mechanism as other tools (more well-known/detectable).
• Option 2: (real Evil Font one) Build a Word doc without invisible fonts, then convert via Print to PDF → more annoying, but produces different IOCs than Option 1.

If anyone figures out how to pull off Option 2 with invisible letters, I owe you a drink. Open an issue and I'll credit you in the README.

Usage

All functionality is exposed via a single CLI with four subcommands.

create — Generate the font family for use in HTML or DOC files

evilfonttool create <reference_font> <output_dir> <font_name>

Argument	Description
reference_font	Path to a .ttf or .woff source font
output_dir	Directory to write fonts and CSS into
font_name	Internal name prefix for the generated font family

Example:

evilfonttool create fonts/Arial.ttf output/ 'Arial'

Outputs:

• output/fonts/*.woff — web fonts, one per character
• output/ttffonts/*.ttf — TTF fonts for document embedding
• output/fonts.css — @font-face declarations for web use

---

Input File Format

• Plain .txt files.
• Each line in computer_file must be equal to or longer than the corresponding line in human_file
• Lines are matched positionally (line 1 to line 1, etc.)

---

web — Generate an Evil Font HTML file

evilfonttool web <human_file> <computer_file> <output_file>

Requires fonts.css and the generated fonts to be in the output directory so the HTML file can use it (or change the path in the HTML file).

Argument	Description
input_human_file	Text visible to human readers. Can be multiple lines
input_computer_file	Text visible to machines / AI. Can be multiple lines
output_file	Path for the generated HTML file

Example:

evilfonttool web human.txt computer.txt output/index.html

---

doc — Generate a Evil Font DOCX file

evilfonttool doc <human_file> <computer_file> <output_file> <font_name> [--author AUTHOR] [--ttf-dir DIR]

The font_name must match the name used in the create step. The TTF fonts must be installed on the system, embedded via --ttf-dir, or embedded manually in Word (file -> options -> save -> embed fonts) for the deception to render correctly.

Word's own "embed fonts" save option works fine, but LibreOffice's does not -- I could never get it to embed Evil Fonts correctly. Pass --ttf-dir instead: EvilFontTool embeds the fonts itself, directly into the .docx, without relying on Word or LibreOffice's embedding at all.

Argument	Description
input_human_file	Text visible to human readers. Can be multiple lines
input_computer_file	Text visible to machines / AI. Can be multiple lines
output_file	Path for the generated DOCX file
font_name	Font family name (must match create step)
--author	DOCX document author metadata (default: none)
--ttf-dir	Directory of Evil Font TTFs (e.g. <output_dir>/ttffonts). If given, the fonts actually used are embedded directly into the .docx, so the deception renders correctly without installing them system-wide. Only embeds letters included in the human file.