Security News > 2024 > July > Microsoft 365 users targeted by phishers abusing Microsoft Forms
There has been an uptick in phishing campaigns leveraging Microsoft Forms this month, aiming to trick targets into sharing their Microsoft 365 login credentials.
Malicious forms leading to phishing pages impersonating Microsoft 365 and Adobe.
Microsoft Forms is part of the Microsoft 365 product suite, and is used to gather feedback and information via survey, quizzes and polls.
The links take users to a Microsoft 365 or Adobe phishing page.
While Microsoft reacted to the threat by implementing automated phishing prevention to detect malicious password collection in forms and surveys, it's obvious that it's not always successful at recognizing malicious embedded links.
"Attackers enhance their forms' credibility by using convincing page titles and known favicons. Favicons are small icons displayed in the browser tab, and by using Microsoft familiar icons, attackers increase the perceived legitimacy of their fake pages. These visual cues can easily trick users into believing they are on a genuine Microsoft site," Perception Point researchers noted.
News URL
https://www.helpnetsecurity.com/2024/07/29/microsoft-365-phishing-forms/
Related news
- ONNX phishing service targets Microsoft 365 accounts at financial firms (source)
- Australian Organizations are Fascinated With Copilot for Microsoft 365, But Will They Avoid The “Gotchas”? (source)
- Microsoft 365, Office users hit by wave of ‘30088-27’ update errors (source)
- June Windows Server updates break Microsoft 365 Defender features (source)
- Major Microsoft 365 outage caused by Azure configuration change (source)
- Microsoft confirms CrowdStrike update also hit Windows 365 PCs (source)
- Microsoft 365 and Azure outage takes down multiple services (source)
- Microsoft 365 anti-phishing feature can be bypassed with CSS (source)
- Microsoft 365 anti-phishing alert “erased” with one simple trick (source)