These messages are coming through thick and fast. We are seeing them daily and they are originating from legitimate email accounts across the globe. The email accounts are hacked Office 365 accounts and the hackers are using the same Office 365 account to create a fake Office 365 login using the Office 365 forms app, so that url looks more authentic (very cute!). The login page doesn’t really look legit, but the fact that it is an office url and is branded Microsoft will likely trick many users.
Warn all users to keep an eye out for Login pages hosted on Microsoft Office Forms and be suspicious.