Phishing scammers use rnicrosoft.com domain to impersonate Microsoft by replacing 'm' with 'rn' in typosquatting attacks that steal login credentials.

Microsoft is warning of an active scam that diverts employees’ paycheck payments to attacker-controlled accounts after first taking over their profiles on Workday or other cloud-based HR services.