Phishing Campaign Targets Job Seekers with Fake Google Forms

Blog.Malwarebytes

Phishing Campaign Targets Job Seekers with Fake Google Forms

First seen 19 Feb 2026, 10:19 UTC • •24.3

Article Content

1 / 5

Browse articles

ThreatCluster •March 12, 2026 at 16:10 UTC

Threat actors are deploying fake Google Forms pages on lookalike domains to deceive job seekers into providing their Google login credentials. This phishing scheme primarily targets individuals searching for employment opportunities, leveraging the trust associated with Google Forms to harvest sensitive information. Users are advised to verify the authenticity of URLs before entering personal data.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 247d ago How this analysis works

Timeline

2026-02-18

Malwarebytes reports on job scam using fake Google Forms

2026-02-19

GBHackers reports on threat actors harvesting Google logins

More articles in this cluster (4)

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Phishing
T1566.002 - Spearphishing Link
T1566 - Phishing

Affected Platform (1)

Google Forms

Relationships

Phishing targets Google Forms
T1566.002 - Spearphishing Link targets Google Forms
T1566 - Phishing targets Google Forms

Continue Reading

Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…

Critical Code Injection Vulnerability in Staggs Plugin for WordPress A critical code injection vulnerability, CVE-2026-78287, has been identified in the Staggs plugin for WordPress, affecting versions up to 3.3.0. This flaw allows unauthenticated attackers to execute arbitrary code remotely, posing severe risks to affected sites. The vulnerability stems from improper control over code…