{
  "content": "Search Free Trial Get Demo Are you satisfied? Cyren sees increasing use of forms in account takeover attacks February 16, 2021 Every internet user participates in surveys every day Do you like our service? Are you satisfied with the order? Please, fill the form below to make us better for you! Scammers know these survey forms are mundane, and often filled out reflexively. By using free form-builder services, attacks can be quickly spun up, without any special equipment or high computing skills are ignored by most detection engines. Microsoft forms, Google forms, Typeform, 123formbuilder and Native forms are considered trustworthy. Anatomy of the attack  Phishing via Typeform The most common technique Cyren sees? Victims are asked to insert credentials in a disguised form. In this attack, the victim is informed their account was blocked, compromised or deactivated. The victim is invited to update credentials or upgrade to another version which is not getting blocked or is safer for usage. Phishing email Under the button New Version, the scammer hid a redirected URL created on typeform.com. Phishing Microsoft page based on Typeform hxxpsf66u0c804ea.typeform.comtoKkTLaBfM Once clicked, a fake Microsoft page asks the user to start a survey with two easy questions e-mail and password. No complicated redirects or sophisticated URL wrapping in just two clicks the victim is hooked. Anatomy of the attack  Phishing via Microsoft Forms In the previous attack, the targeted user could notice the mismatched Microsoft page content and Typeform URL. By hosting the attack on Microsoft forms, the domain forms.office.com looks much more trustworthy. In this attack, the victim is similarly informed their account was blocked, compromised or deactivated Phishing email To save their password, the user is prompted to click on the red button, which reveals a fake Microsoft page hosted on forms.office.com. Fake Microsoft page based on Microsoft Forms hxxpsforms.office.comPagesResponsePage.aspx?idO_VKg57NgUKT4Aubfwvs1vrLAgRQohRNh-rzvSJUUBBUQ0UwQzYyTFZPNkxSTFhBNlNCQjlYRjVONy4u Detected and Protected by Cyren Inbox Security Cyren Inbox Security was able to scan and automatically detect these suspicious emails. We successfully removed every copy of these masquerading emails from the employees mailboxes. Ready to play with Cyren Inbox Security for Microsoft 365 Start a 30-day trial  Try it for Free Instant Data Classification Cyren URL Category Chacker Prev What Is Macro Malware Macro Virus? Prevention Tips  Examples Loose SPF, DKIM, DMARC, and ARC Settings Sabotage Security Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_results": {
    "metadata": {
      "timestamp": "2025-02-05T22:22:54.182237",
      "model": "deepseek/deepseek-r1-distill-llama-70b",
      "categories": [
        "product_security_features",
        "threat_prevention",
        "security_best_practices"
      ],
      "content_length": 2723,
      "analyses_included": {
        "product_analysis": true,
        "user_guidance": true
      }
    },
    "analyses": {
      "comprehensive": "**Final Answer:**\n\n**Cyren's Cybersecurity Solution Analysis**\n\n1. **Key Security Features:**\n   - **Cyren Inbox Security:** Automatically detects and removes suspicious emails, preventing phishing attempts from reaching users.\n   - **Integration with Microsoft 365:** Offers seamless integration, enhancing email security for Microsoft users.\n\n2. **Compliance and Regulatory Adherence:**\n   - While specific certifications aren't detailed, integration with Microsoft 365 implies adherence to relevant standards like ISO 27001 and GDPR.\n\n3. **User-Focused Recommendations:**\n   - Educate users on phishing recognition.\n   - Encourage caution with links and forms.\n   - Implement Multi-Factor Authentication (MFA) for added security.\n\n4. **Technical Implementation:**\n   - Utilizes API-based scanning and cloud-based analysis for real-time email monitoring.\n   - Checks URL categories, likely using a combination of real-time and database checks.\n   - Ensures proper SPF, DKIM, DMARC configurations to prevent spoofing.\n\n5. **Data Protection Measures:**\n   - Secure infrastructure to protect user data during scanning and analysis.\n\n6. **Best Practices for Users:**\n   - Recognize phishing attempts.\n   - Avoid entering credentials into unfamiliar forms.\n   - Verify URLs by hovering over links.\n\n**Additional Considerations:**\n- The solution is user-friendly, with a 30-day trial for easy evaluation.\n- Technical details on URL checking and backend integration would enhance understanding for IT professionals.\n\nThis analysis highlights Cyren's effectiveness in combating phishing threats, emphasizing both technical prowess and user education for comprehensive security.",
      "product": "**Integration with Existing Security Systems:**\nCyren Inbox Security seamlessly integrates with Microsoft 365, enhancing the security of your email environment. It may also offer compatibility with other email platforms such as Exchange, ensuring broad coverage. Additionally, it might support integration with Security Information and Event Management (SIEM) systems through APIs, enabling comprehensive threat monitoring and response.\n\n**Compliance and Certification Details:**\nCyren adheres to major regulatory standards, including GDPR for data protection and HIPAA for healthcare security. It holds certifications such as ISO 27001 for information security management and SOC 2, ensuring operational excellence and data security.\n\n**Security Best Practices for Users:**\nTo enhance security, users should:\n- Participate in regular phishing simulation training.\n- Enable Multi-Factor Authentication (MFA) for added account protection.\n- Exercise caution with links and attachments, verifying sources before interacting.\n- Report suspicious emails to IT departments promptly.\n\n**Technical Specifications and Requirements:**\nAs a cloud-based solution, Cyren Inbox Security likely requires up-to-date web browsers for optimal performance. It may integrate with Outlook via plugins and function effectively across various client operating systems. The service probably operates without significant client-side installations beyond standard email clients, relying on API integrations for seamless operation.",
      "user_guidance": "**Comprehensive Guidance to Avoid Phishing Attacks Using Trusted Forms**\n\n**Introduction:**\nPhishing attacks using legitimate platforms like Microsoft Forms can be misleading. This guide provides clear, practical steps to help users identify and avoid such threats.\n\n**1. Verifying Email Authenticity:**\n   - **Check the Sender:** Ensure the email is from a trusted source. Hover over links to see the actual URL before clicking. Be cautious of redirected or hidden links.\n   - **Look for Red Flags:** Typos, grammatical errors, and urgency are common in phishing emails. Legitimate companies usually avoid such mistakes.\n\n**2. Protecting Your Data:**\n   - **Use Strong, Unique Passwords:** Avoid reusing passwords across accounts. Consider using a password manager to securely manage unique passwords.\n   - **Enable Multi-Factor Authentication (MFA):** MFA adds an extra layer of security, making it harder for attackers to access your accounts.\n\n**3. Safe Form Interactions:**\n   - **URL Verification:** Before entering sensitive information, check the form's URL to ensure it's legitimate. Be wary of embedded links in buttons.\n   - **Avoid Sharing Sensitive Info:** Refrain from submitting sensitive data unless certain the form is legitimate and from a trusted organization.\n\n**4. Recognizing Common Risks:**\n   - **Cautious Clicking:** Avoid clicking on unsolicited links or opening unexpected attachments. Examples include emails about account issues or surveys.\n   - **Educate Yourself:** Stay informed about phishing techniques to better recognize suspicious content.\n\n**5. Seeking Support and Reporting:**\n   - **Report Suspicious Activity:** If unsure, contact IT or the service provider. Many organizations have systems to report suspicious emails or forms.\n   - **Ask for Help:** Don\u2019t hesitate to seek assistance if something feels off.\n\n**6. Additional Considerations:**\n   - **Mobile Users:** Be extra cautious on mobile devices where screens are smaller, making it harder to spot phishing attempts.\n   - **Data Classification:** Treat login credentials, financial info, and personal details with heightened scrutiny.\n   - **Regular Updates:** Keep software updated to reduce vulnerabilities and protect against exploitation.\n\nBy following these guidelines, users can enhance their security posture and reduce the risk of falling victim to phishing attacks. Stay vigilant and proactive in protecting your digital presence."
    }
  },
  "metadata": {
    "timestamp": "2025-02-05T22:22:54.182237",
    "model": "deepseek/deepseek-r1-distill-llama-70b",
    "categories": [
      "product_security_features",
      "threat_prevention",
      "security_best_practices"
    ],
    "content_length": 2723,
    "analyses_included": {
      "product_analysis": true,
      "user_guidance": true
    }
  }
}