Phishers are using fake Google Forms pages hosted on lookalike domains to trick job seekers into handing over their Google credentials.

Security Boulevard is a leading cybersecurity news and information portal, offering articles, analysis, and insights on cybersecurity threats, vulnerabilities, and best practices. From the latest trends in cyber threats to expert commentary on security technologies and compliance frameworks, Security Boulevard provides resources for security professionals, IT leaders, and business executives seeking to protect their organizations from cyber attacks and data breaches.

Security Boulevard

A job-themed phishing campaign uses a lookalike domain (forms.google.ss-o[.]com) to impersonate Google Forms, tricking job seekers into entering their Google credentials. The fake site mimics Google Forms' UI, including logos, color schemes, and even the standard Google disclaimer for authenticity. A PHP script generates personalized URLs to evade researcher analysis. Clicking 'Sign in' redirects victims to a credential-harvesting page on id-v4[.]com, a domain linked to phishing for nearly a year. The campaign likely spreads via targeted emails or LinkedIn messages. Key IOCs are provided, along with basic safety tips such as avoiding unsolicited job links and using a password manager.

Job scam uses fake Google Forms site to harvest Google logins