Freely subscribe to our NEWSLETTER

“Software vendors have a responsibility for monitoring for typo squatting, attack planning and other scams that put their customers at risk. In this instance, what appeared to be an app, was used to trick users into giving criminals access to their Office 365 account contents.

Microsoft also need to recognise that the user experience can contribute to the problem. Office365 users frequently end up being presented with multiple login and authorization screens, asking them to reconnect to their account – often several times in the same session, and for no apparent reason. It’s perhaps not surprising that people occasionally fall for a malicious app, when the genuine user experience is so confusing.

With scams such as this on the increase, users also need to stay ultra-vigilant to avoid giving criminals a free pass to their most valuable data. A well-crafted email can look utterly convincing: educate users in what to look out for, that they need to be suspicious of every email and must alert security teams for anything that looks unusual. Have processes for reviewing any suspicious emails or requests to install or make changes to apps.

Always err on the side of caution. In particular, any emails that appear to be genuine and from a credible source which are asking for money transfers or other critical information should always be verified in person or by phone with the sender.”