![\"Mobile](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/01\/1769555834_252_0x0.jpg\")
<\/p>\n<\/p>\n
Do not use these websites<\/p>\n
NurPhoto via Getty Images<\/p>\n
Updated on Jan. 27 with a new defense against these dangerous websites. <\/p>\n
If you find yourself on one of these malicious websites and do not detect the threat quickly enough, you risk losing accounts, credentials and data. This is worse when it comes to Chrome or Safari on your phone, where spotting threats is harder.<\/p>\n
That\u2019s the case with a new warning reported by Cybersecurity News<\/a>: \u201cHackers are using the \u2018rn\u2019 typo trick to impersonate Microsoft and Marriott in a new phishing attack.\u201d That tactic to use an \u2018r\u2019 and an \u2018n\u2019 to replace a \u201cm\u2019 in a URL on a small screen \u201dcreates fake websites that look nearly identical to the real ones.”<\/p>\n ForbesDo You Suddenly Need To Stop Using WhatsApp On Your Phone?By Zak Doffman<\/a><\/p>\n Homoglyph attacks<\/a>, where \u201cattackers exploit visually similar characters to deceive users or systems, (are) used in phishing, domain impersonation, and software supply chain intrusions\u2014often with high success rates. They\u2019re dangerous because the fake often looks exactly like the real thing.\u201d<\/p>\n Cybersecurity News says two recent attacks leveraging the \u201cr+n\u201d technique have targeted Microsoft and Marriott. Of the two, the Microsoft attack is clearly the more dangerous. Stealing those credentials or hijacking those accounts is invaluable.<\/p>\n \u201cThe security firm Anagram, highlighted a similar campaign targeting Microsoft users. Phishing emails in this campaign use the domain rnicrosoft.com to send fake security alerts or invoice notifications.\u201d<\/p>\n While you can hover to check URLs before clicking through, most users don\u2019t, The most critical advice is never to log into any accounts \u2014 Microsoft, Marriott or any other \u2014 via a link from any kind of message or email. Instead use your app or usual website.<\/p>\n New domains detected<\/p>\n Cybersecurity News<\/p>\n You should also ensure passkeys and two-factor authentication are enabled on all key accounts, which certainly includes Microsoft.<\/p>\n Given this new warning, you should also be mindful of URLs with domains that start with or include the letter \u2018m.\u2019 It\u2019s worth taking care given how hard this \u2018r+n\u2019 is to detect.<\/p>\n Meanwhile, a new update from 1Password clearly shows that fake websites designed to steal user credentials can be stopped without those users having to letter check all URLs, looking for \u201cr+n\u201d or similar trickery on small screen devices.<\/p>\n As Bleeping Computer<\/a> explains, \u201cthe 1Password digital vault and password manager has added built-in protection against phishing URLs to help users identify malicious pages and prevent them from sharing account credentials with threat actors.\u201d<\/p>\n So, how does this work? \u201c1Password will not fill in a user\u2019s login data when visiting a website with a URL that does not match the one stored in their vault.\u201d<\/p>\n ForbesApple\u2019s Next Upgrade Makes iPhone More Like Google\u2019s PixelBy Zak Doffman<\/a><\/p>\n