![\"Fake](\"https:\/\/www.newsbeep.com\/ie\/wp-content\/uploads\/2026\/02\/full_website.png\")
Fake Google Forms site<\/p>\nAs part of our investigation into a job-themed phishing campaign, we came across several suspicious URLs that all looked like this:<\/p>\n
https:\/\/forms.google.ss-o[.]com\/forms\/d\/e\/{unique_id}\/viewform?form=opportunitysec&promo=<\/p>\n
The subdomain forms.google.ss-o[.]com is a clear attempt to impersonate the legitimate forms.google.com. The \u201css-o\u201d is likely introduced to look like \u201csingle sign-on,\u201d an authentication method that allows users to securely log in to multiple, independent applications or websites using one single set of credentials (username and password).<\/p>\n
Unfortunately, when we tried to visit the URLs we were redirected to the local Google search website. This is a common phisher\u2019s tactic to prevent victims from sharing their personalized links with researchers or online analysis.<\/p>\n
After some digging, we found a file called generation_form.php on the same domain, which we believe the phishing crew used to create these links. The landing page for the campaign was: https:\/\/forms.google.ss-o[.]com\/generation_form.php?form=opportunitysec <\/p>\n
The generation_form.php script does what the name implies: It creates a personalized URL for the person clicking that link.<\/p>\n
With that knowledge in hand, we could check what the phish was all about. Our personalized link brought us to this website:<\/p>\n
Fake Google Forms site<\/p>\n
The greyed out \u201cform\u201d behind the prompt promises:<\/p>\n
We\u2019re Hiring! Customer Support Executive (International Process)
\nAre you looking to kick-start or advance your career\u2026
\nThe fields in the form: Full Name, Email address, and an essay field \u201cPlease describe in detail why we should choose you\u201d
\nButtons: \u201cSubmit\u201d and \u201cClear form.\u201d<\/p>\n
The whole web page emulates Google Forms, including logo images, color schemes, a notice about not \u201csubmitting passwords,\u201d and legal links. At the bottom, it even includes the typical Google Forms disclaimer (\u201cThis content is neither created nor endorsed by Google.\u201d) for authenticity.<\/p>\n
Clicking the \u201cSign in\u201d button took us to https:\/\/id-v4[.]com\/generation.php, which has now been taken down. The domain id-v4.com has been used in several phishing campaigns for almost a year. In this case, it asked for Google account credentials.<\/p>\n
Given the \u201cjob opportunity\u201d angle, we suspect links were distributed through targeted emails or LinkedIn messages.<\/p>\n
How to stay safe<\/p>\n
Lures that promise remote job opportunities are very common these days. Here are a few pointers to help keep you safe from targeted attacks like this:<\/p>\n
Do not click on links in unsolicited job offers. Pro tip: Malwarebytes Scam Guard<\/a> identified this attack as a scam just by looking at the URL.<\/p>\n IOCs<\/p>\n id-v4[.]com<\/p>\n forms.google.ss-o[.]com<\/p>\n We don\u2019t just report on scams\u2014we help detect them<\/p>\n Cybersecurity risks should never spread beyond a headline. If something looks dodgy to you, check if it\u2019s a scam using Malwarebytes Scam Guard<\/a>. Submit a screenshot, paste suspicious content, or share a link, text or phone number, and we\u2019ll\u00a0tell you if it\u2019s a scam or legit. Available with Malwarebytes Premium Security<\/a> for all your devices, and in the Malwarebytes app for iOS and Android<\/a>.<\/p>\n *** This is a Security Bloggers Network syndicated blog from Malwarebytes<\/a> authored by Malwarebytes<\/a>. Read the original post at: https:\/\/www.malwarebytes.com\/blog\/scams\/2026\/02\/job-scam-uses-fake-google-forms-site-to-harvest-google-logins<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"As part of our investigation into a job-themed phishing campaign, we came across several suspicious URLs that all…\n","protected":false},"author":2,"featured_media":103709,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[24955,45136,61,60,62712,80],"class_list":["post-304348","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-event","tag-icon","tag-ie","tag-ireland","tag-link","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/304348","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=304348"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/304348\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/103709"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=304348"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=304348"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=304348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nUse a password manager, which would not have filled in your Google username and password on a fake website.
\nUse an up to date, real-time anti-malware solution<\/a> with a web protection component.<\/p>\n![\"forms.google.ss-o.com](\"https:\/\/www.newsbeep.com\/ie\/wp-content\/uploads\/2026\/02\/blocked_by_MBAM.png\")
Blocked by Malwarebytes<\/p>\n