Cybercriminals are exploiting a sophisticated visual trick to steal Microsoft login credentials, using the fake domain “rnicrosoft.com” where the letters ‘r’ and ‘n’ appear as ‘m’ to deceive users into entering their passwords on fraudulent sites.
Story Highlights
- Attackers register rnicrosoft.com domain exploiting font kerning illusion where ‘rn’ visually appears as ‘m’
- Storm-1865 cybercriminal group actively deploys this typosquatting technique for credential theft and financial fraud
- Mobile device users face heightened risk due to shortened URL displays and smaller screen visibility
- Campaign targets work emails with sophisticated Microsoft branding replication to bypass user detection
Sophisticated Visual Deception Targets Microsoft Users
The rnicrosoft.com phishing campaign represents an evolution in typosquatting attacks, exploiting font kerning where adjacent ‘r’ and ‘n’ characters blur together to visually mimic the letter ‘m’. Cybersecurity experts warn this technique capitalizes on human psychology, as the brain predicts familiar words and skips detailed letter examination. The fraudulent domain perfectly replicates Microsoft’s authentic branding, layout, and professional tone to deceive users into clicking malicious links and surrendering their login credentials to attackers.
Microsoft Threat Intelligence attributes this campaign to Storm-1865, a cybercriminal group that has evolved its tactics since 2023 to include ClickFix techniques alongside traditional typosquatting methods. The group previously targeted hospitality and e-commerce sectors through Booking.com impersonation campaigns, demonstrating their adaptability in exploiting trusted brand relationships. Security researchers note the attackers rapidly repurpose successful domains across multiple scam categories, including fake HR notices, payment fraud, and malware distribution schemes targeting both individuals and enterprise environments.
Got this on whatsapp but be very careful folks. DO NOT RESET YOUR PASSWORD because of mails that even look authentic.
Here, they use a domain called rnicrosoft – the "rn" in the beginning looks like "m". Please be aware! pic.twitter.com/7iaDNApstC
— Deepak Shenoy (@deepakshenoy) October 28, 2025
Mobile Users Face Amplified Security Risks
Mobile device users encounter significantly higher vulnerability to this attack due to shortened URL displays and reduced screen real estate for careful inspection. CyberGuy’s analysis emphasizes that smartphone users experience increased cognitive rush during routine login attempts, making subtle visual deceptions particularly effective. The combination of familiar email contexts and mobile browsing limitations creates optimal conditions for successful credential theft, especially when users receive seemingly urgent communications requiring immediate Microsoft account access.
Domain registrars continue enabling malicious registrations like rnicrosoft.com with limited proactive screening measures, forcing reactive takedown responses after security researchers identify active campaigns. Microsoft has developed Edge browser protections that warn users about common typosquatting domains, including variations like “Micorosft.com,” but attackers consistently register new variants to circumvent existing blacklists. The ongoing cat-and-mouse dynamic between security teams and cybercriminals highlights the persistent nature of this threat vector.
Financial Impact and Prevention Strategies
The credential theft enables immediate account takeovers, fraudulent invoice generation, and malware installation across victim systems, with potential for multimillion-dollar fraud chains based on Storm-1865’s historical operations since 2023. Organizations face direct financial losses from stolen funds alongside substantial remediation costs for compromised systems and data breaches. The attack methodology scales beyond Microsoft to target any trusted brand, creating industry-wide implications for cloud service providers, financial institutions, and major retailers vulnerable to similar visual deception techniques.
Security experts recommend immediate behavioral changes including manual URL inspection, hovering over links before clicking, and navigating directly to Microsoft sites rather than following email links. Users should verify sender authenticity through official communication channels and enable multi-factor authentication to limit damage from compromised credentials. The consensus among cybersecurity professionals emphasizes human vigilance over technological solutions alone, as these attacks fundamentally exploit psychological vulnerabilities rather than technical system weaknesses that automated defenses can easily counter.
Sources:
Microsoft typosquatting scam swaps letters to steal logins
How Edge can protect you from typosquatting
Phishing campaign impersonates Booking.com delivers a suite of credential stealing malware
Replace m with rn in microsoft.com
Typosquatting
