Hackers Replace ‘m’ with ‘rn’ in Microsoft(.)com to Steal Login Credentials

A sophisticated phishing campaign is currently exploiting a subtle typographical illusion to deceive users into surrendering sensitive login credentials.

Cybercriminals have registered the domain “rnicrosoft.com,” strategically replacing the letter ‘m’ with the letter combination ‘r’ and ‘n’ to create a near-perfect visual replica of Microsoft’s legitimate domain.

This deceptive tactic works because modern browsers and email clients render fonts differently.

When ‘r’ and ‘n’ appear adjacent to each other, the kerning between these letters often mimics the appearance of the letter ‘m’.

The human brain’s natural tendency to autocorrect text errors makes this visual deception particularly effective, especially when users are scanning emails or viewing content on mobile devices.

Harley Sugarman, CEO of Anagram, recently highlighted this specific attack vector, noting that fraudulent emails often mirror the official Microsoft logo,…