Devious New Phishing Attack Exploits Font Illusion To Create Fake Login Pages
Highlighted in Cyber Security News recently, there's a new set of homoglyph phishing campaigns where attackers register domains that replace the letter "m" with the adjacent characters "r+n." On high-resolution screens, especially on the smaller smartphone displays, the resulting "rn" sequence is virtually indistinguishable from an "m" to the naked eye.
Recent reports have identified major sites like Microsoft and Marriott International as targets. By using addresses such as "rnicrosoft.com" or "rnarriottinternational.com," hackers send out fake security alerts or invoice notifications that look entirely legit. When a user clicks the link, they are directed to a pixel-perfect replica of the company’s login page. Because the URL looks correct at a quick glance, victims often enter their credentials without a second thought, effectively handing the keys to their accounts over to cybercriminals.
Such a threat has even proven to be a problem for browsers like Chrome and Safari that have built-in protections against some forms of domain spoofing, e.g. punycode, which flags international characters. However, since the "rn" trick uses standard Latin characters, detection is much harder.
This leaves the burden of defense on the user. Security specialists warn that mobile users are at the highest risk, as the truncated address bars in mobile browsers often hide the very details that would give the scam away.
"The stakes of one distracted tap are way higher now," warns Harley Sugarman, CEO of security firm Anagram.
To protect yourself from these so-called kerning attacks, experts recommend several critical steps. First, never click on links in unsolicited emails or texts; instead, manually type the website address into your browser. If you have to use the links, try to hover over them before clicking. Second, use a password manager, which is designed to recognize the underlying code of a domain and will refuse to auto-fill your credentials on a fake site like those mentioned above.
