Why do they put cyrillic letters in phishing email?

Question

I have just received this email:

Fог уоuг ргоtесtіоn, уоuг Αррlе ID іѕ аutоmаtісаllу disabled. 

Wе hаνе ргеνеntеd аn unuѕuаl ѕіgn іn аttеmрt оn уоuг Αррlе ассоunt.Тhіѕ ассоunt hаѕ Ьееn lоскеd Ьесаuѕе ѕіgnіng іn fгоm а nеw lосаtіоn ог fгоm а dіffегеnt dеνісе. Рlеаѕе геνіеw thе ѕіgn іn dеtаіlѕ Ьеlоw: 

Υоuг ассоunt ассеѕѕ hаѕ Ьееn lоскеd fог thе fоllоwіng геаѕоn(ѕ):
Wе сhеск уоuг ассоunt lоgіn wіth оthег dеνісе.
Υоuг ассоunt hаѕ Ьееn lоскеd untіl thіѕ іѕѕuеd hаѕ Ьееn геѕоlνеd, wе wіll wаіtіng fог 1 wеек ог уоuг ассоunt hаѕ Ьееn lоскеd регmаnеntlу.
Whаt tо dо Νехt: 
Рlеаѕе Сlіск thе lоgіn Ьuttоn Ьеlоw tо уоuг Αррlе ассоunt аnd ргоνіdе thе геquеѕtеd іnfогmаtіоn Ьеfоге 1 wеек. Тhгоugh thе ассоunt геνіеw, іf wе dоn't гесеіνеd thе іnfогmаtіоn Ьеfоге thіѕ dеаdlіnе, уоuг ассоunt ассеѕѕ wіll Ье lоскеd регmаnеntlу.

Why are these letters used: Ь, ν, к? It makes easier to detect that the message is not genuine.

Answer 1

This is probably for avoiding automatic spam detection, which is often based on the existence of keywords like locked. And locked won't match lоскеd so the spam filter lets the mail go through, and inattentive users might get tricked.

They also use the cyrillic letters in URLs because they often are non-already taken domains (free to be bought by the spammer) and they look-like the legitimate URL to users, so they often end up leaving their credentials of lucky.com to the phising website luскy.com

Answer 2

Hackers use 'Unicode Tricks/Cyrillic characters' to hide their motives and to be undetectable by security defenses/scanners.

Please refer below article for more details on this scenario:

https://www.theguardian.com/technology/2017/apr/19/phishing-url-trick-hackers