I was reading some tweets from @pwnallthethings regarding the John Podesta spear phishing emails.
What the email looked like:
Change Password button link, notice the domain
You're probably thinking "wow how come Google algorithms didn't catch this email, it's right there asking for your password?". Because the letters aren't English to trick the filters. Hackers are smart.
To be specific they are probably Homoglyph unicode characters. Below you can find quite a nice tool to create a text using homoglyphs.
Does Gmail check Unicode now or is this "vulnerability" still in affect? Most of the spam emails I receive are correctly identified but some still slip through. Some using Unicode but some are still plain ASCII characters.
Find Unicode characters using Notepad++:
Some more articles: