Hackers Replace ‘m’ with ‘rn’ in Microsoft(.)com to Steal Login Credentials

A sophisticated phishing campaign is currently exploiting a subtle typographical illusion to deceive users into surrendering sensitive login credentials.

Cybercriminals have registered the domain “rnicrosoft.com,” strategically replacing the letter ‘m’ with the letter combination ‘r’ and ‘n’ to create a near-perfect visual replica of Microsoft’s legitimate domain.

This deceptive tactic works because modern browsers and email clients render fonts differently.

When ‘r’ and ‘n’ appear adjacent to each other, the kerning between these letters often mimics the appearance of the letter ‘m’.

The human brain’s natural tendency to autocorrect text errors makes this visual deception particularly effective, especially when users are scanning emails or viewing content on mobile devices.

Harley Sugarman, CEO of Anagram, recently highlighted this specific attack vector, noting that fraudulent emails often mirror the official Microsoft logo, layout, and tone of legitimate correspondence.

This level of sophistication increases the likelihood that unsuspecting users will interact with the malicious content.

According to CyberSecurity News, the potency of this attack lies in its remarkable subtlety. On high-resolution desktop monitors, discerning observers might notice the irregularity, but most users will miss it.

Mobile devices amplify the risk significantly, as screen space limitations cause address bars to truncate complete URLs, hiding the malicious domain entirely.

Once users believe they are communicating with a trusted entity, they become far more susceptible to clicking malicious links or downloading weaponized attachments.

Attackers leverage this technique to facilitate credential phishing, vendor invoice scams, and internal HR impersonation campaigns.

The ‘rn’ swap represents just one of many variations in the attacker’s toolkit. Other common tactics include replacing the letter ‘o’ with the number ‘0’ (creating “micros0ft.com”) or adding hyphens to legitimate brand names (such as “microsoft-support.com”).

Defending against these homoglyph and typosquatting attacks requires a fundamental shift in user behavior. Security experts strongly recommend that users expand the full sender address before engaging with any unsolicited email.

A simple hover over hyperlinks reveals the actual destination URL, while long-pressing links on mobile devices exposes the deception before a connection is established.

Analyzing email headers, particularly the “Reply-To” field, can reveal whether scammers are routing responses to external, uncontrolled inboxes.

In scenarios involving unexpected password reset requests, the safest approach is to ignore the email link entirely and navigate directly to the official service through a new browser tab.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates