Rather than deploying custom phishing kits, the actors utilize legitimate form-building services, including Google Forms, Wix, Jotform, Zoho Forms, and Microsoft Office, to capture credentials and personally identifiable information (PII). By avoiding the use of explicit keywords like "password" in form fields, attackers attempt to bypass simple automated filters. Once an account is compromised, it is used to send legitimate-looking emails detailing fake job opportunities. Victims are subsequently coerced into mobile check deposits and the purchase of gift cards. The threat actors exhibit aggressive tactics, including threats of legal action and impersonation of law enforcement, if targets fail to comply with the financial demands.

Attack Chain

1. Attacker sends a phishing email to university targets claiming an account must be refreshed due to graduation or retirement.
2. The email redirects the victim to a legitimate third-party form provider (e.g., Google Forms, Jotform).
3. The victim provides account credentials and PII into the hosted form, bypassing filters by following attacker instructions (e.g., using "WORDWORD" as a placeholder for password).
4. The actor logs into the victim's university account using the harvested credentials.
5. The compromised account is used to send bulk emails impersonating faculty or staff, advertising fake remote job opportunities.
6. Victims interact with a second set of malicious forms that harvest personal and financial details.
7. The actor engages the victim via email or phone, instructing them to deposit a fraudulent check and purchase gift cards for "employment" costs.
8. If the victim resists, the actor escalates to threats, impersonation of law enforcement, or harassment to force payment.

Impact

The campaign facilitates significant financial loss for university-affiliated victims through advance fee fraud. Compromised university accounts are used to maintain persistence and establish credibility for broader scam distribution. The aggregation of PII allows for secondary identity theft and more targeted future social engineering. While the number of victims is not explicitly stated, the broad nature of the campaign indicates a high-volume attempt to leverage institutional trust.

Recommendation

Prioritized actions for security teams to mitigate this threat:

• Enforce mandatory multi-factor authentication (MFA) across all university accounts to prevent account takeover via credential phishing.
• Implement email filtering policies that flag or block emails containing links to common third-party form builders when sent from external sources or suspicious internal accounts.
• Educate the user base on the indicators of job-based advance fee fraud, specifically the request for mobile check deposits followed by gift card purchases.
• Monitor for anomalous login behavior or mass-emailing activity originating from internal .edu accounts, which may indicate an account compromise.
• Investigate any reported "IT" communications that direct users to generic, third-party form-hosting websites rather than official university authentication portals.