Threat Actors Using Fake Google Forms Site to Harvest Google Logins
A recent phishing campaign has been identified where malicious actors are utilizing a deceptive version of Google Forms to acquire Google account credentials.
A recent phishing campaign has been identified where malicious actors are utilizing a deceptive version of Google Forms to acquire Google account credentials.
The campaign employs URLs resembling legitimate Google Forms links. These URLs follow a predictable pattern:
https://forms.google.ss-o[.]com/forms/d/e/{unique_id}/viewform?form=opportunitysec&promo=
However, the domain forms.google.ss-o[.]com is fraudulent. The inclusion of "ss-o" is a deliberate attempt to mimic "single sign-on" (SSO), a common authentication method.
An investigation revealed that these URLs redirect to a local Google search page, a known tactic to evade phishing detection by making URLs functional only once.
The fraudulent domain also contains a file named generation_form.php at:
The inclusion of "ss-o" is a deliberate attempt to mimic "single sign-on" (SSO), a common authentication method.
https://forms.google.ss-o[.]com/generation_form.php?form=opportunitysec
This script is likely used to generate unique phishing URLs for potential victims.
Upon accessing the personalized URL, users are directed to a counterfeit Google Forms page, replicating Google's official design, including color schemes and logos. The form deceptively warns users against submitting passwords, building false confidence.
Applicants are prompted to provide their full name, email address, and a brief essay. The "Sign in" button redirects users to the phishing domain id-v4[.]com/generation.php , known for hosting credential-stealing campaigns.
Once credentials are entered, attackers gain immediate access to Google accounts, potentially leading to identity theft, financial fraud, or malware distribution. The campaign is believed to be distributed via targeted phishing emails or LinkedIn messages, particularly aimed at individuals seeking remote work.
To protect against phishing attacks exploiting career opportunities, users should:
Avoid clicking on links or attachments from unsolicited job offers or unknown senders. Verify domain names before entering login credentials. Authentic Google Forms URLs end with google.com . Utilize a password manager to recognize legitimate sites and prevent auto-filling on fake ones. Maintain a real-time anti-malware solution with web protection enabled. Products like Malwarebytes Premium can flag dangerous links.
Job-themed phishing remains a significant threat due to its exploitation of individuals' ambitions and trust in reputable platforms. Vigilance and careful link inspection are crucial defenses.
Based on reporting by GBHackers.