If you type your credentials on that site, you’re handing them over to thieves. The malicious link is labeled, “Navigate to access statement.” If you click the link, you’re actually sent to a malicious web page that asks for your Microsoft Office 365 credentials. Instead, it’s a malicious link that is supposedly needed to “take the survey.” However, the reply-to domain isn’t legitimate. Here’s how the scam works: thieves send potential victims an email through a real SurveyMonkey domain,. If not familiar, SurveyMonkey has around for over 20 years and hosts real surveys for anyone who signs up for an account.
Scammers have found a way to bypass spoofing legitimate emails and are sending their scams through actual emails from a legitimate survey company and are targeting Microsoft Office 365 clients.Īccording to researchers at Abnormal Security, cybercriminals are sending phishing emails through legitimate survey company SurveyMonkey. Welp, get ready for some next-level deception.
