Threat Actors Using Fake Google Forms Site to Harvest Google Logins

A new phishing campaign is targeting job seekers through fake Google Forms websites designed to steal login credentials.

The campaign uses sophisticated domain impersonation techniques to trick victims into revealing their Google account information.

Attackers have registered a fraudulent domain that closely mimics the legitimate Google Forms service.

The phishing operation revolves around suspicious URLs using the subdomain forms.google.ss-o[.]com, which attempts to impersonate the legitimate forms.google.com address.

The “ss-o” portion appears designed to resemble “single sign-on,” an authentication method that allows users to access multiple applications with one set of credentials. This clever naming choice adds legitimacy to the fake domain.

When victims receive these phishing links through targeted emails or LinkedIn messages, they are directed to what appears to be an authentic Google Forms page.

The fake form advertises a Customer Support Executive position, requesting applicants to provide their name, email, and explain why they deserve the role.

Malwarebytes analysts identified this campaign during their investigation into job-themed phishing attacks, revealing the extent of this credential harvesting operation.

The attackers implemented redirect mechanisms to prevent security researchers from analyzing their infrastructure. When suspicious URLs were accessed, victims were redirected to local Google search pages.

Technical Infrastructure Behind the Attack

The phishing crew deployed a file called generation_form.php on their domain to create personalized URLs for each victim. This script generates unique links that track individual targets.

The fake website replicates Google Forms design elements, including official logos, color schemes, and the standard disclaimer stating “This content is neither created nor endorsed by Google.”

When victims click the “Sign in” button, they are redirected to id-v4[.]com/generation.php, which has been used in phishing campaigns for nearly a year.

Security experts recommend several protective measures. Never click links in unsolicited job offers, regardless of how legitimate they appear.

Using a password manager provides protection, as these tools will not autofill credentials on fraudulent websites. Implementing real-time anti-malware solutions helps detect and block phishing attempts.

Organizations should educate employees about identifying suspicious domains and verifying job opportunities through official channels.

Enabling multi-factor authentication on Google accounts adds security that prevents unauthorized access even if credentials are stolen.

Indicators of Compromise

Domain	Status
id-v4[.]com	Taken down
forms.google.ss-o[.]com	Active phishing domain

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.