Skip to content
eastbaycyber

What is a typosquatting attack? A Practitioner's Definition

FAQs 5 min read
EC
East Bay Cyber Editorial Team Reviewed 2026-08-05
Short answer

TL;DR - Typosquatting is the abuse of misspelled or lookalike names to trick users into visiting, installing, or trusting the wrong thing. - It commonly affects domains, software packages, mobile apps, and social handles. - Treat it as a phishing, malware, and brand-abuse risk that needs monitoring and user verification controls.

Definition

A typosquatting attack is a deception technique where an attacker registers or publishes a name that is very close to a legitimate one, hoping a user will mistake it for the real thing. In practice, that lookalike can be a website domain, software package, app listing, username, or even a cloud resource name.

How it works

Typosquatting works because people skim. Users type quickly, trust familiar brands, and often do not inspect small differences in names, URLs, or package identifiers.

Attackers typically start by identifying a valuable target, such as a company brand, internal portal, open source package, payroll login page, or popular SaaS platform. They then create a near match using one of several common patterns:

  • Simple misspellings: micorsoft.com instead of microsoft.com
  • Missing or extra characters: gooogle.com
  • Character swaps: rnicrosoft.com where rn looks like m
  • Wrong domain suffixes: .co instead of .com
  • Hyphenation tricks: secure-microsoft-login.example
  • Unicode or homoglyph abuse: visually similar letters from another script
  • Package name confusion: installing reqeusts instead of requests

Once the fake asset is live, the attacker uses it in one of a few ways:

  1. Credential theft: A cloned login page collects usernames, passwords, MFA codes, or session cookies.
  2. Malware delivery: The site or package drops infostealers, remote access trojans, or adware.
  3. Traffic monetization: The lookalike page serves ads, affiliate redirects, or spam.
  4. Supply chain compromise: A malicious package sneaks into builds, developer laptops, or CI runners.
  5. Brand impersonation: The fake property is used in phishing emails, fake support scams, or business email compromise setups.

For defenders, the key point is that typosquatting is not limited to domains. Security teams often focus on web URLs, but developers may be hit through package repositories, mobile marketplaces, browser extensions, and social media impersonation.

Why practitioners care

Typosquatting sits at the intersection of phishing, identity abuse, and software supply chain risk.

For an SMB owner, the risk may look like a fake Microsoft 365 login page sent to staff. For an IT admin, it may be a user clicking a fake VPN portal during a password reset campaign. For a developer or DevOps team, it may be a malicious package imported into a build because the package name looked right at a glance.

The impact usually falls into one or more of these buckets:

  • Account takeover
  • Malware infection
  • Data theft
  • Reputation damage
  • Unauthorized payments or invoice fraud
  • Compromised software builds

That is why typosquatting should be handled as both a user awareness issue and a monitoring problem.

When you’ll encounter it

You are most likely to encounter typosquatting in routine, high-trust workflows where people move quickly and do not verify every character.

Email and login flows

This is the most common scenario. A user receives a message that appears to come from a trusted vendor, bank, HR system, or internal admin team. The link points to a lookalike domain hosting a cloned sign-in page.

Examples include:

  • Password expiration notices
  • MFA re-enrollment prompts
  • Shared document notifications
  • Payroll or benefits updates
  • Vendor invoice review requests

Software installation and development

Developers and admins often install tools from memory or copy package names without deep validation. Attackers abuse that habit by uploading similarly named packages to public registries or publishing lookalike Git repositories.

Common environments include:

  • npm, pip, PyPI, RubyGems, or container registries
  • PowerShell modules and admin utilities
  • Browser extensions
  • Terraform modules or CI helper actions

Mobile and app ecosystems

Users may install a fake mobile app or extension that imitates a bank, VPN client, crypto wallet, or productivity tool. The app may request excessive permissions or redirect authentication traffic.

Brand monitoring and customer trust

Organizations encounter typosquatting when customers report suspicious domains, fake support pages, or impersonation on social media. For security teams, these reports are often the first sign of a phishing campaign targeting the brand.

What to do next

If you are defending an organization, the practical response is straightforward:

  • Train users to verify names, not just branding
  • Bookmark critical portals and admin consoles
  • Use password managers that auto-fill only on exact domains
  • Monitor for lookalike domains and package names
  • Block newly observed malicious domains through DNS, web filtering, or email controls
  • Require phishing-resistant MFA where possible
  • Review software dependencies before adding new packages
  • Have a takedown process for impersonating domains and apps

For developers, one of the best controls is to pin dependencies, review maintainers, and avoid installing packages based only on a quick visual check.

Technical Notes

Below are a few practical examples of what defenders may inspect.

Check the final URL before submitting credentials

Expected: https://login.microsoftonline.com/
Suspicious: https://login-micr0softonline.com/
Suspicious: https://microsoftonline-support.example/

Review installed packages carefully

pip install requests
pip show requests

# Verify exact package name and source before using a new dependency
pip freeze | grep -i request

Hunt proxy or DNS logs for suspicious lookalikes

login-micr0softonline.com
okta-verify-login.example
gooogle-auth.example

Use WHOIS or passive DNS tooling during triage

whois suspicious-example.com
dig suspicious-example.com

These checks will not prevent every incident, but they reduce the chance that a fake asset gets trusted long enough to succeed.

Typosquatting overlaps with several other security concepts, but the terms are not identical.

  • Phishing: A broader tactic for tricking users into revealing information or taking unsafe actions. Typosquatting is often one method used in phishing.
  • Homograph attack: A lookalike-name attack using visually similar characters, often from different alphabets. This is a specialized form of lookalike abuse.
  • Combosquatting: A deceptive name built by combining a real brand with extra words, such as paypal-support-login.example, rather than relying on a typo alone.
  • Brand impersonation: Any misuse of a company identity to deceive users, including fake domains, social accounts, or apps.
  • Dependency confusion: A supply chain attack where a package manager resolves a malicious package instead of the intended internal one. Related, but distinct from typo-based package names.
  • Malvertising: Ads that push users toward deceptive or malicious pages, sometimes including typosquatted destinations.

Bottom line

A typosquatting attack is the use of a misspelled or lookalike name to exploit user trust. You will encounter it most often in phishing links, fake login pages, malicious packages, and impersonation campaigns. The practical defense is to combine user verification habits, monitoring for lookalikes, and stronger controls around authentication and software sourcing.

For further reading, check out our articles on CVE-2026-14956 and CVE-2026-39938.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-08-05

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.