Beware of the new Phishing Attack Which Uses Google Forms; Here's how the Tactic Works

BazaCall phishing scammers employ Google Forms to deceive victims

Google and the services it offers from mail to documents to online forms as well as drive, have become integral parts of life for people working online. But this digital exposure and credibility that the tech giant offers, can also be exploited to fool unsuspecting victims. In a concerning development, the notorious BazaCall phishing scammers are adopting new tactics to enhance the authenticity of their malicious campaigns. Security experts have detected a shift in their modus operandi, with the threat actors now leveraging Google Forms to add a layer of credibility to their deceptive schemes.

The evolution of BazaCall's phishing tactics

The BazaCall phishing attacks, initially observed in 2020, have become more sophisticated with time. In these attacks, cybercriminals send emails disguised as legitimate subscription notices, prompting recipients to contact a so-called support desk urgently. The ruse is to dispute or cancel a fictitious plan, with potential charges ranging from $50 to $500.

False sense of urgency and remote access ploys

To manipulate victims, the attackers induce a sense of urgency, urging targets to engage in a phone call. During this call, scammers convince victims to grant remote access using desktop software, claiming to assist in canceling the alleged subscription. Popular services like Netflix, Hulu, Disney+, Masterclass, McAfee, Norton, and GeekSquad are often impersonated to lure unsuspecting victims.

Google forms exploited as a deceptive conduit

In the latest variant of BazaCall attacks, cybersecurity firm Abnormal Security has identified the use of Google Forms as a tool to collect details related to fake subscriptions. The attackers cleverly enable response receipts in the form, sending copies of the responses to the victim's email. This manipulation is designed to make the responses appear as payment confirmations for legitimate services, such as Norton Antivirus.

Exploiting trusted domains and dynamic URLs

The choice of Google Forms introduces an additional layer of cunning, as responses originate from the trusted domain "forms-receipts-noreply@google.com." This tactic increases the likelihood of bypassing secure email gateways, enhancing the phishing campaign's effectiveness. Moreover, Google Forms' use of dynamically generated URLs makes it challenging for traditional security measures to detect and block threats, as these URLs constantly change.

Implications and future threat landscape

The adoption of Google Forms by BazaCall scammers showcases their adaptability and willingness to exploit trusted platforms. This evolution in tactics, combined with the use of dynamic URLs, poses a significant challenge to conventional security measures. As threat actors continue to refine their methods, organizations and individuals must stay vigilant against phishing attempts to safeguard their sensitive information.

BazaCall's incorporation of Google Forms into their phishing attacks highlights the ever-changing landscape of cybercrime. The blending of social engineering tactics with trusted platforms highlights the need for continuous cybersecurity awareness and advanced threat detection measures. As the threat landscape evolves, security experts emphasize the importance of staying informed and adopting proactive security measures to mitigate the risk of falling victim to such deceptive schemes.