What is a typosquatting attack? A Practitioner's Definition
TL;DR - Typosquatting is the abuse of misspelled or lookalike names to trick users into visiting, installing, or trusting the wrong thing. - It commonly affects domains, software packages, mobile apps, and social handles. - Treat it as a phishing, malware, and brand-abuse risk that needs monitoring and user verification controls.
Definition
A typosquatting attack is a deception technique where an attacker registers or publishes a name that is very close to a legitimate one, hoping a user will mistake it for the real thing. In practice, that lookalike can be a website domain, software package, app listing, username, or even a cloud resource name.
How it works
Typosquatting works because people skim. Users type quickly, trust familiar brands, and often do not inspect small differences in names, URLs, or package identifiers.
Attackers typically start by identifying a valuable target, such as a company brand, internal portal, open source package, payroll login page, or popular SaaS platform. They then create a near match using one of several common patterns:
- Simple misspellings:
micorsoft.cominstead ofmicrosoft.com - Missing or extra characters:
gooogle.com - Character swaps:
rnicrosoft.comwherernlooks likem - Wrong domain suffixes:
.coinstead of.com - Hyphenation tricks:
secure-microsoft-login.example - Unicode or homoglyph abuse: visually similar letters from another script
- Package name confusion: installing
reqeustsinstead ofrequests
Once the fake asset is live, the attacker uses it in one of a few ways:
- Credential theft: A cloned login page collects usernames, passwords, MFA codes, or session cookies.
- Malware delivery: The site or package drops infostealers, remote access trojans, or adware.
- Traffic monetization: The lookalike page serves ads, affiliate redirects, or spam.
- Supply chain compromise: A malicious package sneaks into builds, developer laptops, or CI runners.
- Brand impersonation: The fake property is used in phishing emails, fake support scams, or business email compromise setups.
For defenders, the key point is that typosquatting is not limited to domains. Security teams often focus on web URLs, but developers may be hit through package repositories, mobile marketplaces, browser extensions, and social media impersonation.
Why practitioners care
Typosquatting sits at the intersection of phishing, identity abuse, and software supply chain risk.
For an SMB owner, the risk may look like a fake Microsoft 365 login page sent to staff. For an IT admin, it may be a user clicking a fake VPN portal during a password reset campaign. For a developer or DevOps team, it may be a malicious package imported into a build because the package name looked right at a glance.
The impact usually falls into one or more of these buckets:
- Account takeover
- Malware infection
- Data theft
- Reputation damage
- Unauthorized payments or invoice fraud
- Compromised software builds
That is why typosquatting should be handled as both a user awareness issue and a monitoring problem.
When you’ll encounter it
You are most likely to encounter typosquatting in routine, high-trust workflows where people move quickly and do not verify every character.
Email and login flows
This is the most common scenario. A user receives a message that appears to come from a trusted vendor, bank, HR system, or internal admin team. The link points to a lookalike domain hosting a cloned sign-in page.
Examples include:
- Password expiration notices
- MFA re-enrollment prompts
- Shared document notifications
- Payroll or benefits updates
- Vendor invoice review requests
Software installation and development
Developers and admins often install tools from memory or copy package names without deep validation. Attackers abuse that habit by uploading similarly named packages to public registries or publishing lookalike Git repositories.
Common environments include:
npm,pip,PyPI,RubyGems, or container registries- PowerShell modules and admin utilities
- Browser extensions
- Terraform modules or CI helper actions
Mobile and app ecosystems
Users may install a fake mobile app or extension that imitates a bank, VPN client, crypto wallet, or productivity tool. The app may request excessive permissions or redirect authentication traffic.
Brand monitoring and customer trust
Organizations encounter typosquatting when customers report suspicious domains, fake support pages, or impersonation on social media. For security teams, these reports are often the first sign of a phishing campaign targeting the brand.
What to do next
If you are defending an organization, the practical response is straightforward:
- Train users to verify names, not just branding
- Bookmark critical portals and admin consoles
- Use password managers that auto-fill only on exact domains
- Monitor for lookalike domains and package names
- Block newly observed malicious domains through DNS, web filtering, or email controls
- Require phishing-resistant MFA where possible
- Review software dependencies before adding new packages
- Have a takedown process for impersonating domains and apps
For developers, one of the best controls is to pin dependencies, review maintainers, and avoid installing packages based only on a quick visual check.
Technical Notes
Below are a few practical examples of what defenders may inspect.
Check the final URL before submitting credentials
Expected: https://login.microsoftonline.com/
Suspicious: https://login-micr0softonline.com/
Suspicious: https://microsoftonline-support.example/
Review installed packages carefully
pip install requests
pip show requests
# Verify exact package name and source before using a new dependency
pip freeze | grep -i request
Hunt proxy or DNS logs for suspicious lookalikes
login-micr0softonline.com
okta-verify-login.example
gooogle-auth.example
Use WHOIS or passive DNS tooling during triage
whois suspicious-example.com
dig suspicious-example.com
These checks will not prevent every incident, but they reduce the chance that a fake asset gets trusted long enough to succeed.
Related terms
Typosquatting overlaps with several other security concepts, but the terms are not identical.
- Phishing: A broader tactic for tricking users into revealing information or taking unsafe actions. Typosquatting is often one method used in phishing.
- Homograph attack: A lookalike-name attack using visually similar characters, often from different alphabets. This is a specialized form of lookalike abuse.
- Combosquatting: A deceptive name built by combining a real brand with extra words, such as
paypal-support-login.example, rather than relying on a typo alone. - Brand impersonation: Any misuse of a company identity to deceive users, including fake domains, social accounts, or apps.
- Dependency confusion: A supply chain attack where a package manager resolves a malicious package instead of the intended internal one. Related, but distinct from typo-based package names.
- Malvertising: Ads that push users toward deceptive or malicious pages, sometimes including typosquatted destinations.
Bottom line
A typosquatting attack is the use of a misspelled or lookalike name to exploit user trust. You will encounter it most often in phishing links, fake login pages, malicious packages, and impersonation campaigns. The practical defense is to combine user verification habits, monitoring for lookalikes, and stronger controls around authentication and software sourcing.
For further reading, check out our articles on CVE-2026-14956 and CVE-2026-39938.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.