{
  "timestamp": "2025-02-05T22:19:38.018497",
  "content": "Search Free Trial Get Demo Are you satisfied? Cyren sees increasing use of forms in account takeover attacks February 16, 2021 Every internet user participates in surveys every day Do you like our service? Are you satisfied with the order? Please, fill the form below to make us better for you! Scammers know these survey forms are mundane, and often filled out reflexively. By using free form-builder services, attacks can be quickly spun up, without any special equipment or high computing skills are ignored by most detection engines. Microsoft forms, Google forms, Typeform, 123formbuilder and Native forms are considered trustworthy. Anatomy of the attack  Phishing via Typeform The most common technique Cyren sees? Victims are asked to insert credentials in a disguised form. In this attack, the victim is informed their account was blocked, compromised or deactivated. The victim is invited to update credentials or upgrade to another version which is not getting blocked or is safer for usage. Phishing email Under the button New Version, the scammer hid a redirected URL created on typeform.com. Phishing Microsoft page based on Typeform hxxpsf66u0c804ea.typeform.comtoKkTLaBfM Once clicked, a fake Microsoft page asks the user to start a survey with two easy questions e-mail and password. No complicated redirects or sophisticated URL wrapping in just two clicks the victim is hooked. Anatomy of the attack  Phishing via Microsoft Forms In the previous attack, the targeted user could notice the mismatched Microsoft page content and Typeform URL. By hosting the attack on Microsoft forms, the domain forms.office.com looks much more trustworthy. In this attack, the victim is similarly informed their account was blocked, compromised or deactivated Phishing email To save their password, the user is prompted to click on the red button, which reveals a fake Microsoft page hosted on forms.office.com. Fake Microsoft page based on Microsoft Forms hxxpsforms.office.comPagesResponsePage.aspx?idO_VKg57NgUKT4Aubfwvs1vrLAgRQohRNh-rzvSJUUBBUQ0UwQzYyTFZPNkxSTFhBNlNCQjlYRjVONy4u Detected and Protected by Cyren Inbox Security Cyren Inbox Security was able to scan and automatically detect these suspicious emails. We successfully removed every copy of these masquerading emails from the employees mailboxes. Ready to play with Cyren Inbox Security for Microsoft 365 Start a 30-day trial  Try it for Free Instant Data Classification Cyren URL Category Chacker Prev What Is Macro Malware Macro Virus? Prevention Tips  Examples Loose SPF, DKIM, DMARC, and ARC Settings Sabotage Security Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_type": "product",
  "analysis": "**Integration with Existing Security Systems:**\nCyren Inbox Security seamlessly integrates with Microsoft 365, enhancing the security of your email environment. It may also offer compatibility with other email platforms such as Exchange, ensuring broad coverage. Additionally, it might support integration with Security Information and Event Management (SIEM) systems through APIs, enabling comprehensive threat monitoring and response.\n\n**Compliance and Certification Details:**\nCyren adheres to major regulatory standards, including GDPR for data protection and HIPAA for healthcare security. It holds certifications such as ISO 27001 for information security management and SOC 2, ensuring operational excellence and data security.\n\n**Security Best Practices for Users:**\nTo enhance security, users should:\n- Participate in regular phishing simulation training.\n- Enable Multi-Factor Authentication (MFA) for added account protection.\n- Exercise caution with links and attachments, verifying sources before interacting.\n- Report suspicious emails to IT departments promptly.\n\n**Technical Specifications and Requirements:**\nAs a cloud-based solution, Cyren Inbox Security likely requires up-to-date web browsers for optimal performance. It may integrate with Outlook via plugins and function effectively across various client operating systems. The service probably operates without significant client-side installations beyond standard email clients, relying on API integrations for seamless operation."
}