Your Eyes Can’t See This Threat

Your Eyes Can’t See This Threat

Hackers Are Swapping Letters to Steal Microsoft Credentials — And It’s Working

A sophisticated phishing campaign is exploiting one of the oldest human vulnerabilities: the brain’s tendency to autocorrect what it sees. Attackers are registering fake domains like rnicrosoft(.)com — swapping the letter m with the characters r + n. On many screens, especially mobile, the difference is almost invisible.

This is typosquatting at its most dangerous.

And for SMBs, healthcare, law firms, and schools, this attack vector is a direct line into email accounts, vendor portals, HR systems, and cloud environments.

How the Attack Works

Hackers send emails that look exactly like legitimate Microsoft notices — same colors, same layout, same tone. But the domain isn’t microsoft.com.

It’s rnicrosoft.com.

The kerning between “r” and “n” forms a shape that resembles “m,” tricking the eye and slipping past rushed employees. Once someone clicks, attackers launch:

• Credential phishing

• Vendor invoice fraud

• HR impersonation

• Remote access malware drops

These campaigns are especially effective on mobile devices, where:

• URLs are truncated

• Font spacing is tighter

• Visual differences nearly disappear

This is visual deception engineered for speed and scale.

Why This Matters for Your Organization

1. Attackers know your staff moves fast

Most employees skim emails, especially Microsoft alerts. Typosquatting exploits that reflex.

2. Mobile workflows increase exposure

Teachers, nurses, caseworkers, attorneys, and field staff read email on the go. Mobile previews hide full domains — the perfect storm for homoglyph attacks.

3. Automated filters won’t catch everything

These domains are technically “valid.” Without user awareness, even strong defenses crumble.

4. One stolen login becomes a full compromise

From an inbox, attackers can pivot into:

• OneDrive

• SharePoint

• Teams

• EHR platforms

• Legal management systems

• School administrative portals

Many ransomware events start from a single stolen credential.

How to Defend Against Typosquatting

Every organization must train staff to perform these checks:

✔ Expand the full sender address

Don’t rely on display names like “Microsoft Support.”

✔ Hover over links (or long-press on mobile)

This exposes the true destination URL before you click.

✔ Inspect the “Reply-To” field

Attackers often route replies to unrelated inboxes.

✔ Never reset passwords through email links

Open a new browser tab and go directly to the real site.

✔ Rehearse these scenarios

Simulated phishing drills help teams recognize homoglyph tricks in real time.

Common Variations Attackers Use

• rnicrosoft(.)com — “rn” to mimic “m”

• micros0ft(.)com — zero instead of “o”

• microsoft-support(.)com — fake “support” subdomains

• microsoft(.)co — TLD switching

Attackers count on the fact that your brain will fill in the gaps.

Your defense starts with awareness.

If your team can’t detect visual deception, your network becomes an open door.

70% of all cyber attacks target small businesses, I can help protect yours.

#cybersecurity #MSP #managedIT #dataprotection #SMBsecurity