Cybercriminals have launched a sophisticated new phishing campaign targeting Microsoft users. This attack uses a deceptive “typosquatting” technique to steal login credentials. Hackers are registering domains like “rnicrosoft.com“, where the letters “r” and “n” are placed together to mimic the letter “m”.
This attack, flagged by Harley Sugarman, CEO of cybersecurity firm “Anagram”, relies on an optical illusion. In many modern digital fonts, the kerning (spacing) between “r” and “n” makes them appear fused. Consequently, they look nearly identical to the letter “m”.
To a casual observer, noreply@rnicrosoft.com looks exactly like a legitimate Microsoft address. The threat is even more dangerous on mobile devices. Smaller screens and truncated address bars make these subtle differences much harder to spot.
Hackers design these emails to mirror official Microsoft correspondence perfectly. They copy the official logo, layout, colour palette, and tone. Once a user trusts the email, the attackers deploy various scams. These include fake credential harvesting pages, fraudulent vendor invoices, and internal HR impersonation campaigns.
This “rn” swap is just one tool in the attackers’ kit. They use other visual cheats to fool victims. Common variants include:
Automated security filters often miss these domains because they are technically valid and may not initially host malware. Therefore, users must be vigilant.