Scammers use 'rnicrosoft' typo to trick users

A phishing email uses the domain rnicrosoft.com, where 'rn' looks like 'm' to mimic official Microsoft correspondence

The image is a screenshot of two consecutive Twitter/X posts. The first post by user @Jeremyybtc shows a photo of a phishing email disguised as an official Microsoft password reset request. The sender email appears to be [email protected] at a quick glance, but an annotation highlights that the actual domain is "rnicrosoft.com", where adjacent letters 'r' and 'n' visually mimic the letter 'm' to trick users. The first post caption reads "The scammers are evolving 💀". The second post, a reply from user @lifeandtimesv, says "Not gonna lie, on Monday like this they would have gotten my ass 😭", referencing how easy it is to miss the subtle typo when tired or unfocused at the start of a work week.

This content originated as a public thread on the social media platform Twitter/X, and was later reposted to 9Gag under the title "Sharing is caring". The scam shown uses a common real-world typo-squatting tactic, and the post went viral due to its relatable commentary about lower attentiveness on Mondays making users more vulnerable to these tricks.