Forest Global Training Partners

Cyber Risks · Cisco Talos

Spammers abuse Google Forms’ quiz to deliver scams

Summary: Cisco Talos observed a rise in spam abusing a Google Forms quiz feature: spammers create a quiz, submit a response using the victim's email address, and use the "Release scores" option to send a customizable message from Google's own servers with the subject "Score released:". A recent campaign led victims through a second Google Form to the domain go-procoinwhu[.]top, created October 28, 2023, which redirected via Cloudflare to a fake Bitcoin-mining site claiming the victim held more than 1.3 Bitcoin worth over $46,000, then to a chat with an "agent" named Sophia demanding a 0.25% exchange fee of $64.

Key Takeaway: The email arrives from Google's infrastructure, so it clears the trust check most recipients and filters apply to unknown senders. The attackers built an entire fake site, scripted chat, and staged forms to collect $64 - and the connected Bitcoin wallet was still empty as of November 6, 2023.

Read the original at Cisco Talos ↗

Topics
Malware
Related