Loading story…
Threat actors have been using Google Forms as trusted, TLS-protected infrastructure to steal credentials and exfiltrate victim data, blending malicious activity into traffic bound for legitimate Google services. Observed campaigns included spam and phishing operations targeting Microsoft online accounts and Office 365 users, with stolen information funneled through Google Forms into attacker-controlled spreadsheets.
Sophos also documented malware and scripts that programmatically submitted host data to docs.google.com using Google Forms submission formats. One highlighted sample, checkbrowser.exe, was an AutoIT-compiled payload delivered through a compromised Italian WordPress site; it modified Windows settings, collected system information, and sent the results to Google-backed infrastructure. The activity underscores how attackers exploit reputable cloud platforms because they are inexpensive, encrypted, and often implicitly trusted by defenders.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Sophos published research describing how phishing and malware operators abused Google Forms as trusted TLS-protected infrastructure for credential theft and data exfiltration. The report highlighted spam campaigns targeting Microsoft accounts and malware samples that submitted host data to Google Forms-backed spreadsheets.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple malware delivery campaigns using **malicious email**, **fake browser updates**, and likely **content injection** on compromised websites to install infostealers and remote access trojans. One campaign abused WordPress sites to present a fake **Google Chrome** update that delivered credential-stealing malware, while another used malicious **PEC** email lures tied to crypto-wallet themes to infect targets with remote access tooling and theft-focused payloads. Separate reporting also described spam operations distributing evasive malware through email, showing continued reliance on social engineering and web-based lures to gain initial access. The activity aligns with attacker use of **MITRE ATT&CK** techniques including `T1659` for content injection and `T1555` for stealing credentials from password stores. Once installed, these malware families commonly target saved passwords and account data from browsers, email clients, FTP/SFTP tools, Wi-Fi profiles, and Windows credential stores using utilities and methods associated with tools such as **LaZagne**, **Mimikatz**, **MailPassView**, and **Network Password Recovery**. The campaigns underscore a persistent threat pattern in which adversaries combine deceptive delivery methods with credential theft to expand access, move laterally, and compromise additional systems.
Aug 11, 2026
Multiple active phishing operations are leveraging *trusted services* and *by-design web/authentication features* to bypass security controls and harvest credentials and MFA data. **GTFire** is a large-scale credential-harvesting campaign that hides behind legitimate Google-owned domains by abusing **Firebase** and **Google Translate** to make phishing links appear trustworthy to email filters and web gateways; victims are sent to brand-impersonation login pages and then redirected to the real site after submitting credentials. Separately, Microsoft reported phishing that abuses **OAuth redirection** behavior in identity providers (including **Microsoft Entra ID** and **Google Workspace**) by registering malicious OAuth apps with attacker-controlled redirect URIs and using silent auth flows/invalid scopes to bounce users to attacker infrastructure; Microsoft disabled the identified malicious Entra OAuth applications but noted related activity continues and requires monitoring. A distinct but thematically similar campaign uses a fake Google Account security site to trick users into installing a **malicious Progressive Web App (PWA)** that can steal one-time passcodes (via **WebOTP** where supported), harvest data (e.g., clipboard contents), and even turn the victim’s browser into an attacker-controlled **proxy** with internal port-scanning capability; Malwarebytes-linked reporting highlighted the lure domain `google-prism[.]com` and the use of permission prompts (notifications/clipboard) to enable ongoing abuse. Other items in the set cover unrelated threats (Android malware using generative AI for persistence, an Iraq-focused APT toolchain, a separate AiTM phishing-kit attribution case study, and research on a cybercrime infrastructure provider), and do not describe the same specific phishing operations described above.
Jun 29, 2026
Cybercriminals have launched a sophisticated phishing campaign that exploits Google Cloud's Application Integration service to send emails that closely mimic legitimate Google notifications. By leveraging the service's "Send Email" task, attackers are able to distribute messages from the trusted `noreply-application-integration@google.com` address, effectively bypassing traditional email security measures such as DMARC and SPF. The phishing emails are crafted to resemble routine enterprise communications, including voicemail alerts and file access requests, increasing the likelihood that recipients will trust and interact with them. Over a two-week period, nearly 9,400 phishing emails targeted approximately 3,200 organizations across the U.S., Asia-Pacific, Europe, Canada, and Latin America. The attack chain employs a multi-stage redirection process to evade detection and maximize credential theft. Initial links in the emails direct users to legitimate Google Cloud URLs (`storage.cloud.google.com`), followed by a redirection to `googleusercontent.com` where a fake CAPTCHA is presented to bypass automated scanners. The final stage leads victims to a counterfeit Microsoft login page hosted on a non-Microsoft domain, designed to harvest user credentials. This campaign demonstrates the increasing abuse of trusted cloud infrastructure for phishing, highlighting the need for organizations to scrutinize even seemingly authentic emails originating from reputable domains.
Jun 29, 2026