IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

BEC scammers are using Google Forms to identify easy victims

That unexpected Google Form may be benign, but it can lead to more aggressive tactics

Google Forms opening screen on a smartphone

Security researchers have observed a new tactic business email compromise (BEC) threat actors are using to identify easy victims for future attacks.

The new campaign, which involved thousands of messages predominantly delivered to retail, telecommunications, healthcare, energy, and manufacturing sectors, uses simple emails and Google Forms. The threat actors intentionally leave the Google Forms untitled, making them appear “broken” or unexpected.

According to Proofpoint researchers, the hackers behind the attack use this technique as reconnaissance to pinpoint targets who are particularly susceptible to emails with a sense of urgency and who are prone to clicking links.

In a blog post, researchers said using Google Forms to compose and send emails allows the, to evade email filters. The subjects are unique names of C-level executives from the target organizations, with no attempt to use display-name spoofing. 

The emails are simple but convey a sense of urgency by demanding the recipient completes a "Quick Task" for the threat actor, who claims to be heading into a meeting or too preoccupied to handle the task themselves. 

The link in the email leads the user to a default, untitled form hosted on Google Forms. Researchers said the goal is to elicit a reply from the victim that the survey is broken or not what they expected.  

“As a secondary goal, the form likely serves as a sensor to simply see if anyone fills out their form, functioning as a reconnaissance technique to weed out users who may be susceptible to clicking a suspicious link found in an email,” researchers added.

While these messages may appear primitive, researchers warned there’s still a threat in responding to the email or completing the benign form because user action may lead to follow-up actions honed for a more receptive audience.

“Given the C suite spoofing, we expect that this is an email reconnaissance campaign to enable target selection for undetermined follow-on threat activity. The tone of urgency in the emails is consistent with previous BEC actors, and therefore, we want to ensure security awareness of these attempts as an indication or warning to customers and the security community,” said researchers.

Featured Resources

2022 State of the multi-cloud report

What are the biggest multi-cloud motivations for decision-makers, and what are the leading challenges

Free Download

The Total Economic Impact™ of IBM robotic process automation

Cost savings and business benefits enabled by robotic process automation

Free Download

Multi-cloud data integration for data leaders

A holistic data-fabric approach to multi-cloud integration

Free Download

MLOps and trustworthy AI for data leaders

A data fabric approach to MLOps and trustworthy AI

Free Download

Recommended

'CryWiper' trojan disguises as ransomware, says Kaspersky
malware

'CryWiper' trojan disguises as ransomware, says Kaspersky

2 Dec 2022
Hyundai vulnerability allowed remote hacking of locks, engine
Security

Hyundai vulnerability allowed remote hacking of locks, engine

30 Nov 2022
Revealed: The top 200 most common passwords of 2022
cyber security

Revealed: The top 200 most common passwords of 2022

17 Nov 2022
Major security exploits expected to rise before New Year
vulnerability

Major security exploits expected to rise before New Year

1 Nov 2022

Most Popular

Empowering employees to truly work anywhere
Sponsored

Empowering employees to truly work anywhere

22 Nov 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

15 Nov 2022
The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

14 Nov 2022