Why this looks valid

• The email appears to be from Marist University

Why this is phishing

• The from address in this case was a Marist user address but wasn't someone from Information Technology
• There is no branding or other indicators that this is a valid email
• The link goes to a form that is not hosted at Marist or on any approved collaboration services such as Microsoft Office Forms
• The form is collecting user information and requests users to input information about current academic institutions, as well as previous and future ones
• There is no valid signature in this email
• The email is requesting urgent action and uses a scare tactic that your account will be deleted if you do not take action

Additional notes

• This is an extremely dangerous phishing attempt. If you click on a link and/or fill in your Marist credentials, please visit https://myaccount.marist.edu/react to reset your password. Please also contact the Help Desk immediately at x4357 (HELP) or helpdesk@marist.edu to let them know you entered credentials.
• Spelling and grammatical errors are good indicators of malicious emails.
• Remember:  Always check the link. You can hover over the link in the email to ensure that it goes to the service referenced in the email. On a mobile device, you can tap and hold the link to preview the page and see the website location.
• Remember:  Always verify Duo pushes were initiated by you. The attacker was able to get into user accounts after users willingly accepted pushes initiated by the attacker. Marist IT will never request your DUO codes or passwords. 
• Report this message to Microsoft. In Outlook on the Web, click the Junk menu, and select Phishing.
• Remember: A little paranoia goes a long way! Slow down when you receive emaisl requesting urgent action and be suspicious of any email messages similar to this one.