{"id":260675,"date":"2023-11-15T06:34:07","date_gmt":"2023-11-15T11:34:07","guid":{"rendered":"https:\/\/sftarticles.wpenginepowered.com\/es\/?p=315236"},"modified":"2025-07-01T17:40:11","modified_gmt":"2025-07-02T00:40:11","slug":"scammers-are-taking-advantage-of-google-forms-to-try-to-steal-money-from-users","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/scammers-are-taking-advantage-of-google-forms-to-try-to-steal-money-from-users\/","title":{"rendered":"The scammers are using Google Forms to try to steal money from users"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/blog.talosintelligence.com\/google-forms-quiz-spam\/\" target=\"_blank\" rel=\"noopener nofollow\" title=\"\">As discovered by security researchers at Cisco Talos<\/a>, scammers have now found <strong>a way to abuse Google Forms to conduct a new spam and phishing campaign<\/strong>. The cybercriminals sending these malicious messages to users&#8217; emails are also using a fake <a href=\"https:\/\/en.softonic.com\/articles\/better-ia-do-homework-exams-find-a-job\" target=\"_blank\" rel=\"noopener\" title=\"\">AI chatbot<\/a> with <strong>the aim of stealing cryptocurrencies from anyone who falls into the trap<\/strong>, likely also transacting through those payment methods.<\/p>\n\n\n<div class=\"sc-card-program\">\r\n  <div class=\"sc-card-program__body\">\r\n    <div class=\"sc-card-program__row clearfix\">\r\n      <div class=\"sc-card-program__col-logo\">\r\n        <img decoding=\"async\" class=\"sc-card-program__img\" src=\"https:\/\/images.sftcdn.net\/images\/t_app-icon-s\/p\/b2e6d43a-96bf-11e6-a674-00163ed833e7\/965337810\/chrome-Google_Chrome_logo.png\" alt=\"Google Chrome\" width=\"100px\" height=\"100px\">\r\n      <\/div>\r\n      <div class=\"sc-card-program__col-title\">\r\n        <span class=\"sc-card-program__title\">Google Chrome<\/span>\r\n        <a class=\"sc-card-program__button sc-card-program-internal\" href=\"https:\/\/chrome.en.softonic.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">DOWNLOAD<\/a>\r\n      <\/div>\r\n      <div class=\"sc-card-program__col-rating\">\r\n        <svg class=\"rating-score__content\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" version=\"1.1\" x=\"0\" y=\"0\" viewbox=\"0 0 50 50\" enable-background=\"new 0 0 50 50\" xml:space=\"preserve\"><path class=\"rating-score__background rating-score--good\" fill=\"none\" stroke-width=\"6\" stroke-miterlimit=\"10\" d=\"M40 40c8.3-8.3 8.3-21.7 0-30s-21.7-8.3-30 0 -8.3 21.7 0 30\"><\/path><path class=\"rating-score__value rating-score__value--0\" fill=\"none\" stroke-width=\"6\" stroke-dashoffset=\"0\" stroke-miterlimit=\"10\" d=\"M40 40c8.3-8.3 8.3-21.7 0-30s-21.7-8.3-30 0 -8.3 21.7 0 30\"><\/path><text class=\"rating-score__number\" content=\"\" text-anchor=\"middle\" transform=\"matrix(1 0 0 1 25 31.0837)\" data-auto=\"app-user-score\"><\/text><\/svg>\r\n      <\/div>\r\n    <\/div>\r\n    <div class=\"sc-card-program__row\">\r\n      <span class=\"sc-card-program__description\"><\/span>\r\n    <\/div>\r\n    <div class=\"sc-card-program__row\">\r\n      <img decoding=\"async\" class=\"sc-card-program__bigpic\" src=\"\" onerror=\"this.style.display='none'\">\r\n    <\/div>\r\n    <a class=\"sc-card-program__link track-link sc-card-program-sponsored\" href=\"https:\/\/chrome.en.softonic.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\"><\/a>\r\n  <\/div>\r\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">As is often the case, this procedure is capable of deceiving many users. However, to put everyone&#8217;s mind at ease, at the moment this new scam method was brought to light, <strong>they hadn&#8217;t managed to steal any money from potential victims<\/strong>. Cisco Talos hasn&#8217;t hesitated to state that this new tactic <strong>pays &#8220;extraordinary attention to detail.&#8221; <\/strong>Clearly, <strong>all of this is conducted through Google Forms<\/strong>, at least it all begins with the mentioned service from Mountain View.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">This is the new spam and phishing campaign by cyber scammers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">It seems that the first thing scammers do is create <strong>a new file in Forms<\/strong>, choosing the option that allows converting that file into a questionnaire. After this, the attackers set up two very key aspects to carry out their attack: <strong>one is to publish the grades later, once the manual review is done<\/strong> (which allows the questionnaire to <strong>collect email addresses<\/strong> of potential victims) and the <strong>&#8220;responder&#8217;s entry&#8221; in responses<\/strong>, enabling attackers to <strong>complete the form using the potential victim&#8217;s email address<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With all this done, <strong>Google Forms can generate a link to the document that criminals can access to complete it<\/strong>. Then, they can click on &#8220;release scores,&#8221; triggering the service to send a notification to the victim&#8217;s email. What&#8217;s interesting is that <strong>this notification message can be fully customized before sending<\/strong>, showing an exaggerated attention to detail. Regardless of what the message says, this entire process ultimately aims to deceive someone into <strong>believing that, a year ago, apparently, they logged into a bitcoin cloud mining service and completely neglected it<\/strong>.<\/p>\n\n\n<div class=\"sc-card-program\">\r\n  <div class=\"sc-card-program__body\">\r\n    <div class=\"sc-card-program__row clearfix\">\r\n      <div class=\"sc-card-program__col-logo\">\r\n        <img decoding=\"async\" class=\"sc-card-program__img\" src=\"https:\/\/images.sftcdn.net\/images\/t_app-icon-s\/p\/b2e6d43a-96bf-11e6-a674-00163ed833e7\/965337810\/chrome-Google_Chrome_logo.png\" alt=\"Google Chrome\" width=\"100px\" height=\"100px\">\r\n      <\/div>\r\n      <div class=\"sc-card-program__col-title\">\r\n        <span class=\"sc-card-program__title\">Google Chrome<\/span>\r\n        <a class=\"sc-card-program__button sc-card-program-internal\" href=\"https:\/\/chrome.en.softonic.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">DOWNLOAD<\/a>\r\n      <\/div>\r\n      <div class=\"sc-card-program__col-rating\">\r\n        <svg class=\"rating-score__content\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" version=\"1.1\" x=\"0\" y=\"0\" viewbox=\"0 0 50 50\" enable-background=\"new 0 0 50 50\" xml:space=\"preserve\"><path class=\"rating-score__background rating-score--good\" fill=\"none\" stroke-width=\"6\" stroke-miterlimit=\"10\" d=\"M40 40c8.3-8.3 8.3-21.7 0-30s-21.7-8.3-30 0 -8.3 21.7 0 30\"><\/path><path class=\"rating-score__value rating-score__value--0\" fill=\"none\" stroke-width=\"6\" stroke-dashoffset=\"0\" stroke-miterlimit=\"10\" d=\"M40 40c8.3-8.3 8.3-21.7 0-30s-21.7-8.3-30 0 -8.3 21.7 0 30\"><\/path><text class=\"rating-score__number\" content=\"\" text-anchor=\"middle\" transform=\"matrix(1 0 0 1 25 31.0837)\" data-auto=\"app-user-score\"><\/text><\/svg>\r\n      <\/div>\r\n    <\/div>\r\n    <div class=\"sc-card-program__row\">\r\n      <span class=\"sc-card-program__description\"><\/span>\r\n    <\/div>\r\n    <div class=\"sc-card-program__row\">\r\n      <img decoding=\"async\" class=\"sc-card-program__bigpic\" src=\"\" onerror=\"this.style.display='none'\">\r\n    <\/div>\r\n    <a class=\"sc-card-program__link track-link sc-card-program-sponsored\" href=\"https:\/\/chrome.en.softonic.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\"><\/a>\r\n  <\/div>\r\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">By instilling a bit of fear into potential victims, <strong>they manage to coax them into being &#8220;helped&#8221; by an obviously fake AI chatbot<\/strong>. This chatbot supposedly assists in <strong>converting the cryptocurrency in question into fiat currency so they can withdraw the remaining cash<\/strong> (as they claim to have taken a portion of the money deposited in that service). After this &#8220;assistance&#8221; from the chatbot, <strong>it requests a fee for the service, around 64 dollars, which must be paid in bitcoin to an address provided by the bot itself<\/strong>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>As discovered by security researchers at Cisco Talos, scammers have now found a way to abuse Google Forms to conduct a new spam and phishing campaign. The cybercriminals sending these malicious messages to users&#8217; emails are also using a fake AI chatbot with the aim of stealing cryptocurrencies from anyone who falls into the trap, &hellip; <a href=\"https:\/\/cms-articles.softonic.io\/en\/scammers-are-taking-advantage-of-google-forms-to-try-to-steal-money-from-users\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;The scammers are using Google Forms to try to steal money from users&#8221;<\/span><\/a><\/p>\n","protected":false},"author":9280,"featured_media":260679,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":2},"categories":[1015],"tags":[5771],"usertag":[],"vertical":[],"content-category":[],"class_list":["post-260675","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-google-forms"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/260675","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/users\/9280"}],"replies":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/comments?post=260675"}],"version-history":[{"count":1,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/260675\/revisions"}],"predecessor-version":[{"id":316436,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/260675\/revisions\/316436"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media\/260679"}],"wp:attachment":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media?parent=260675"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/categories?post=260675"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/tags?post=260675"},{"taxonomy":"usertag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/usertag?post=260675"},{"taxonomy":"vertical","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/vertical?post=260675"},{"taxonomy":"content-category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/content-category?post=260675"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}