Spammers Abuse Google Forms Quizzes to Perform Scams

Here’s how it works

• After submission, spammers can view the responses and activate the "Release scores" feature on Google Forms. 
• This enables them to send customized email messages, using the Google account's "From:" address, potentially increasing the chance of delivery to the victim's inbox since the emails come from Google's servers.

Sample scam

• Clicking on the ‘View’ button redirected users to the fake Google form response that asked them to confirm their email address. 
• Consequently, they were directed to an external link that prompted them to take action to activate their accounts that contained Bitcoins worth more than $46,000.
• To make it look more convincing, victims were then assisted via a live chat session to fill in their names, and email addresses.
• At the final stage, the victims were instructed to pay an exchange fee of ‘0.25%’ or $64 by scanning a QR code to claim the amount.

Google features actively targeted

• The latest scam comes a few days after Google warned of threat actors exploiting its Calendar service to host C2 infrastructure. 
• The exploitation was being carried out through a tool called Google Calendar RAT, which was first published to GitHub in June.
• The tool enabled attackers to exploit the event descriptions in Google Calendar to create a covert channel.

Ending notes