Cybercriminals Replace ‘m’ with ‘rn’ to Fool Microsoft Users

A new and very smart phishing scam is targeting Microsoft users. Cybercriminals are using a tiny visual trick to fool Microsoft users and steal their login details. They have created a fake domain that looks almost exactly like the real “microsoft.com”. But instead of using the letter “m”, they replace it with the letters “r” and “n” placed close together (rn). The fake domain looks like “rnicrosoft.com”.

At a quick glance, many users cannot spot the difference. The letters “r” and “n” appear similar to “m” in certain fonts and sizes. This simple trick is now being used widely by cybercriminals to run phishing attacks.

This method is known as typosquatting. It depends on how fonts appear on screens and how our brain reads familiar words. When people see the word “microsoft”, they quickly assume it is correct. The brain fills in the expected pattern and ignores the small visual differences.

Security experts warn that this attack is very effective. Harley Sugarman, the CEO of Anagram, pointed out that these phishing emails often look exactly like real Microsoft emails. They use the same logo, same layout, and sometimes even copy the writing style. This makes it even harder for users to detect the scam.

How the Attack Works

The danger increases on mobile devices. Mobile screens are small, and the address bar usually hides or shortens the full website address. This makes it easier for the fake “rnicrosoft.com” to appear real. On top of that, people often check emails on their phones while busy or distracted. This gives the attackers a better chance of success.

Once users trust the fake email, they may click a malicious link that takes them to a fake login page. They may also download harmful attachments. The attackers then steal the entered credentials or install malware on the device.

Hackers are not limited to the “rn” trick. They use many other techniques. Some replace the letter “o” with the number “0”. Some add hyphens or extra letters to make the domain appear official. These are known as homoglyph attacks, where characters look visually similar but are actually different.

See Also: Cybercriminals Use SVG Images in Fake Facebook Posts to Spread Malware

How to Stay Safe

Defending against such attacks requires careful attention from users. Relying only on spam filters or antivirus tools is not enough. Cybersecurity experts suggest a few simple steps:

• Always check the full email address before clicking anything.
• Hover your mouse over any link to see the real URL.
• On mobile, long-press the link to preview the full address.
• Look closely at the “Reply-To” field in suspicious emails.
• If you get an unexpected password reset email, do not click the link. Instead, open a new browser tab and visit the official site manually.

Organizations should also train employees to spot these tricks. Regular awareness sessions help reduce accidental clicks.

In today’s digital world, tiny details can make a big difference. A small swap like “m” to “rn” is enough to fool thousands. Staying alert is the best defense against such clever cyberattacks.