A sophisticated homoglyph phishing campaign is targeting customers of Marriott International and Microsoft, using a deceptive visual trick to steal credentials and sensitive data.
Attackers are registering malicious domains that replace the letter “m” with the combination “rn” (r + n), creating fake websites that appear nearly identical to legitimate ones.
This technique, known as typosquatting or a homoglyph attack, exploits how modern fonts render text.
In many standard fonts, when the letters “r” and “n” are placed next to each other (rn), they look visually indistinguishable from the letter “m”, as reported by CSN.
Hackers rely on this visual deception to bypass users’ natural ability to spot errors. When you glance at a URL like rnarriottinternational.com, your brain often “autocorrects” what it sees, assuming it says “Marriott”.
Recent Campaigns Identified
Marriott International Targeted
Security firm Netcraft recently identified a cluster of malicious domains attempting to impersonate the hotel giant. These domains are likely being used to steal loyalty account credentials or personal guest data.
The primary domain identified is rnarriottinternational.com, while attackers have also registered variations like rnarriotthotels.com to target specific hotel brands.
Microsoft Users Under Fire
Harley Sugarman, CEO of security firm Anagram, highlighted a similar campaign targeting Microsoft users.
Phishing emails in this campaign use the domain rnicrosoft.com to send fake security alerts or invoice notifications.
These emails closely mimic the official Microsoft logo, tone, and layout. The attack is hazardous on mobile devices, where small screens make the “rn” versus “m” difference almost impossible to detect.
Indicators of Compromise (IOCs)
The following domains have been flagged as malicious. Security teams should block these immediately, and users should avoid any links directing to them:
| Phishing Domain | Impersonated Service | Typosquatting Technique | Detection Difficulty |
|---|---|---|---|
rnarriottinternational.com | Marriott International | ‘m’ replaced with ‘rn’ | Critical |
rnarriotthotels.com | Marriott Hotels | ‘m’ replaced with ‘rn’ | Critical |
rnicrosoft.com | Microsoft 365 / Login | ‘m’ replaced with ‘rn’ | High (Mobile) |
micros0ft.com | Microsoft | ‘o’ replaced with ‘0’ | Medium |
microsoft-support.com | Microsoft Support | Hyphenation / Suffix | Low |
How to Stay Safe
Expand the Sender Address: On mobile email apps, tap the sender’s name to reveal the full email address and look closely for the “rn” trick.
Hover Before You Click: On a computer, hover your mouse cursor over links without clicking to see the actual destination URL.
Manual Entry: If you receive an urgent email about a hotel booking or account reset, do not click embedded links. Open a browser and manually type marriott.com or microsoft.com.
Use Password Managers: Password managers will not auto-fill credentials on fake sites like rnicrosoft.com because they recognize the domain differs from the legitimate one, providing an additional layer of protection against these attacks.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
