Evil Fonts present a deceptive visual illusion by displaying a different character than what is stored on the disk. This technique can be embedded within various file formats including HTML, DOCX, and PDFs, wherever custom fonts are permissible. They are particularly effective in Windows corporate environments for circumventing security measures and achieving initial access. This exploitation method bypasses JavaScript-free click fixing and man-in-the-middle web security tools. Evil Fonts can also be used to set up traps across a network for harvesting shell access. For instance, a user might attempt to copy the command "whoami" but inadvertently execute "rm -rf ~" due to the font's deception. Demos of this tool are available online, illustrating its functionality. When using these demos, it's advised to copy and paste content into a text editor to remove the malicious fonts. In AI scenarios, security tools might analyze benign text from disk, while the user perceives malicious content. The associated GitHub repository includes labs and walkthroughs for further exploration. Practical applications of Evil Fonts include poisoning AI queries for homework assignments and compromising help desk documentation. They can also be employed to bypass email filters and facilitate click fixing.