Top 7 ways threat actors abuse Google Forms
Malicious hackers are increasingly using Google Forms to launch sophisticated attacks both against individuals and organizations.
New research from cybersecurity company Sophos describes how cyber attackers – from entry-level scammers to advanced adversaries – abuse Google Forms to implement a wide range of attacks, targeting organizations and individuals.
“The extent to which cyberattackers abuse Google Forms came to light while we were researching how malware abuses encryption to conceal its activities and communications,” Sean Gallagher, a senior threat researcher at Sophos, is quoted in a press release. “Google Forms offer cyberattackers an attractive proposition: the forms are easy to implement and trusted by both organizations and consumers; the traffic to and from the service is secured with Transport Layer Security (TLS) encryption so defenders can’t easily inspect it, and the whole set up essentially provides a free attack infrastructure.”
The analysis shows that while most abuse of Google Forms by cyberattackers remains firmly in the low-skill phishing and fraud spam space, there are increasing signs that adversaries are taking advantage of the platform to carry out more sophisticated attacks.
Researchers identified seven ways cyber scammers and malware operators abuse Google Forms:
1. Phishing: even though Google warns users on every page of a form not to enter password details, Sophos found several examples where attackers tried to convince potential victims to enter their credentials into a Google form laid out to resemble a login page. These forms were often tied to malicious spam campaigns.
2. Malicious spam campaigns: one of the largest sources of Google Forms links in spam were ‘unsubscribe’ links in scam-related marketing emails. Sophos has intercepted several spam-based phishing campaigns that targeted Microsoft online accounts, including Office 365. The spam claimed that recipients’ email accounts were about to be shut down if they were not immediately verified and offered a link to a Google form that asked the user to enter their Microsoft credentials. These Google Forms pages were decorated with Microsoft graphics but were still clearlyGoogle Forms.
3. Payment card data theft: entry-level scammers use Google Forms’ ready-made design templates to attempt to steal payment data through faked “secure” e-commerce pages.
4. Potentially Unwanted Applications (PUAs), such as adware: the researchers discovered a number of PUAs targeting Windows users. These apps use Google Forms pages surreptitiously, with the web requests collected and submitted to forms automatically, without any need for user interaction.
5. Fake user interfaces for malicious Android apps: Sophos found some malicious Android applications that used Google Forms to capture data without having to code a back-end website. Most of these were adware or PUAs. For instance, the researchers found SnapTube, a video app that generates revenue for the developer through web advertising fraud and includes a Google Forms page for user feedback.
6. Data removal: the researchers uncovered several more sophisticated threats abusing Google Forms. This included malicious Windows applications that used web requests to Google Forms pages to ‘push’ stolen data from computers to a Google spreadsheet via Google Forms.
7. Part of the more expansive malicious cyberattack infrastructure: Sophos telemetry has detected a number of PowerShell scripts interacting with Google Forms. They were able to prototype how PowerShell scripts could scrape Windows profiling data from a computer and submit it to a Google Forms form automatically.
“Google frequently shuts down accounts associated with a mass abuse of applications, including Google Forms,” said Gallagher. “However, the kind of low-volume, targeted use of Forms by some malware could stay under the radar. Business defenders need to be alert to this threat and apply caution whenever they see links to Google Forms or any other legitimate services trying to obtain credentials, and they should not inherently trust TLS traffic to ‘known good’ domains such as docs.google.com.”
More from CyberNews:
Massive analysis of 311 million malware warnings: here’s how hackers fool us
Subscribe to our newsletter