Office 365 will check for phishing attempts in Microsoft Forms

Microsoft is working on adding a new phishing attempt control feature for Microsoft Forms that will allow Office 365 admins to block forms that try to collect users' sensitive data.

Microsoft Forms is a web and mobile app that allows users to create surveys, quizzes, and polls designed to collect feedback and data online.

It was previously only available to business users with Microsoft 365 Personal and Microsoft 365 Family, but recently it was made available for personal use to anyone with a Microsoft account.

Block potential phishing attempts

“When managing Microsoft forms, IT admins have two options in response to potential phishing: you can either click “unblock” or “confirm phishing,” a new option that is now available,” Redmond explains in a new Microsoft 365 Roadmap entry.

Phishing attempts are detected by Microsoft Forms with the help of proactive phishing detection, a protection feature that will proactively detect the collection of malicious code in forms and surveys.

Such forms will be automatically blocked and will not be able to continue collecting responses. This is done as a precaution to prevent fraudsters from abusing the forms as “phishing landing pages”.

Admins will receive notifications for all forms detected and blocked for potential phishing.

Checking for potentially malicious forms

Starting with the rollout of the feature to all standard multi-tenants during November 2020, IT admins can review all forms that are automatically flagged as phishing attempts and are attempting to collect sensitive user to use in future malicious campaigns.

To check and unblock phishing forms, administrators should follow these steps:

1. Sign in to the Microsoft 365 admin center at admin.microsoft.com.
2. Go to the Message center and look for the alert, Prevent/Fix: Microsoft Forms Detected Potential Phishing (this alert contains a daily summary of all blocked forms)
3. Click the Forms admin review URL in the notification to review blocked forms.
4. For each form you check, go to the top right corner of the page and choose whether to unblock or confirm the phishing attempt (unblock the ones that are incorrectly marked and confirm the ones you want to block due to malicious intent)

“If you believe a form has malicious intent, no further action is required from you. The form will remain blocked until owner removes the content that has been flagged for maliciously collecting sensitive data,” Microsoft explains.

Source: bleepingcomputer.com