Telecom
Sophos Uncovers Top 7 Ways Cyberscammers, Malware Operators Abuse Google Forms
Sophos, a global leader in next-generation cybersecurity, has published research, “Phishing and Malware Actors Abuse Google Forms for Credentials, Data Exfiltration,” describing how cyberattackers – from entry-level scammers to advanced adversaries – abuse Google Forms to implement a wide range of attacks, targeting both organizations and individuals.
Sean Gallagher, senior threat researcher at Sophos, “The extent to which cyberattackers abuse Google Forms came to light while we were researching how malware abuses encryption to conceal its activities and communications.
“Google Forms offer cyberattackers an attractive proposition: the forms are easy to implement and trusted by both organizations and consumers; the traffic to and from the service is secured with Transport Layer Security (TLS) encryption so it can’t be easily inspected by defenders; and the whole set up essentially provides a free attack infrastructure.
“Our analysis shows that while most abuse of Google Forms by cyberattackers remains firmly in the low-skill phishing and fraud spam space, there are increasing signs that adversaries are taking advantage of the platform for more sophisticated attacks.
“Sophos’ examples of this include attackers using Google Forms to exfiltrate data and for malware command-and-control.”
Below are the seven ways that Sophos researchers have identified cyberscammers and malware operators abusing Google Forms:
Phishing: Despite the fact that Google warns users on every page of a form not to enter password details, Sophos found several examples where attackers tried to convince potential victims to enter their credentials into a Google Form laid out to resemble a login page. These forms were often tied to malicious spam campaigns.
Malicious spam campaigns: One of the largest sources of Google Forms links in spam were “unsubscribe” links in scam-related marketing emails. Sophos has intercepted a number of spam-based phising campaigns that targeted Microsoft online accounts, including Office365. The spam claimed that recipients’ email accounts were about to be shut down if they were not immediately verified, and offered a link to a Google Form that asked the user to enter their Microsoft credentials. These Google Forms pages were decorated with Microsoft graphics but, still, clearly a Google Form.
Payment card data theft: Entry-level scammers use Google Forms’ ready-made design templates to attempt to steal payment data through faked “secure” e-commerce pages.
Potentially Unwanted Applications (PUAs), such as adware: The researchers discovered a number of PUAs targeting Windows users. These apps use Google Forms pages surreptitiously, with the web requests collected and submitted to forms automatically without any need for user interaction.
Fake user interfaces for malicious Android apps: Sophos found some malicious Android applications that made use of Google Forms to capture data without having to code a back-end website. Most of these were adware or PUAs. For instance, the researchers found “SnapTube,” a video app that generates revenue for the developer through web advertising fraud and which includes a Google Forms page for user feedback.
Data removal: The researchers uncovered a number of more sophisticated threats abusing Google Forms. This included malicious Windows applications that used web requests to Google Forms pages to ‘push’ stolen data from computers to a Google spreadheet via Google Forms.
Part of the wider malicious cyberattack infrastructure: Sophos telemetry has detected a number of PowerShell scripts interacting with Google Forms. We were able to prototype how PowerShell scripts could be used to scrape Windows profiling data from a computer and submit it to a Google Forms form automatically.
“Google frequently shuts down accounts associated with a mass abuse of applications, including Google Forms,” said Gallagher. “However, the kind of low-volume, targeted use of Forms by some malware could stay under the radar. Business defenders need to be alert to this threat and apply caution whenever they see links to Google Forms, or any other legitimate services trying to obtain credentials, and they should not inherently trust TLS traffic to ‘known good’ domains such as docs.google.com.”
Sophos products, including Intercept X for endpoints, defend against most malicious spam that carry forms-based phishing campaigns and detect the behaviors of system information collection discussed in the new research.
Sophos also advises consumers to install a security solution, such as Sophos Home, on the devices that they and their families use for online communications and gaming to protect everyone from malware and cyberthreats.
MTN Group, the continent’s telecom behemoth, has plunged into advanced negotiations to acquire the outstanding 75 percent stake in IHS Towers for a staggering $2.76 billion, a seismic move that would hand Africa’s largest mobile operator full reins over one of the world’s premier independent tower companies and redefine infrastructure control across emerging markets.
MTN
The proposed transaction, pegged to IHS’s latest New York Stock Exchange closing price where it trades alongside a Frankfurt listing, builds on MTN’s existing 25 percent holding forged in a landmark 2014 deal that saw the operator offload most tower assets to IHS in exchange for cash and long-term leases.
Sources close to the talks confirm discussions remain fluid with no binding agreement yet inked, and both sides caution that negotiations could shift or stall entirely—MTN has signalled readiness to pivot to alternative value-unlocking strategies for its stake if a full buyout eludes grasp.
Strategically, the power play catapults MTN toward vertical integration in a sector where operators increasingly crave direct grip on passive infrastructure to slash lease bills, streamline upgrades, and rocket-roll 4G/5G amid Africa’s insatiable data deluge.
IHS Towers, MTN’s anchor tenant across swathes of Africa with tens of thousands of masts from Nigeria’s 13,500 tenancies—renewed amid naira-dollar tussles—to South Africa and beyond the Middle East into Latin America, represents a golden infrastructure war chest primed for the operator’s 20-nation blitz.
The saga traces to 2014’s seismic sale that freed MTN capital for spectrum wars while birthing enduring lease pacts, now ripe for reversal as governance dust-ups over shareholder nominations and agendas underscore the buyout’s boardroom chess.
Market tremors rippled through IHS shares post-leak, underscoring the $2.76 billion tag’s gravity as MTN eyes cost efficiencies, network agility, and expansion muscle in oil-volatile economies where tower mastery spells survival.
Should the ink dry, MTN vaults to ownership of a colossus fuelling digital bridges from Lagos megacities to rural frontiers, slashing third-party dependence while supercharging investments in fibre-deep data dreams and 5G horizons.
Analysts buzz that the mega-deal heralds telecom consolidation waves, with operators reclaiming tower turf to fortify against rivals and unlock synergies in a landscape where infrastructure crowns kings.
Neither MTN nor IHS commented officially by press time, but the high-stakes huddle spotlights Africa’s telecom arena hurtling toward an era where owning the poles decides who dominates the digital skies.
Nigerian Communications Commission (NCC) and the Nigeria Security and Civil Defence Corps (NSCDC) have issued a forceful warning to road construction companies, government contractors and civil engineering firms across the country, declaring that the era of unchecked fibre-optic cable damage during excavation works is over, with perpetrators now facing criminal prosecution.
NCC, NSCDC
The two agencies, in a joint statement, highlighted the alarming surge in avoidable fibre cuts caused by negligence, poor planning or outright disregard for infrastructure protection protocols, stressing that such incidents severely disrupt Nigeria’s digital backbone and will attract the full weight of the law moving forward.
They described fibre optic cables as indispensable national assets that fuel the nation’s burgeoning digital economy, ensuring uninterrupted communication services, powering emergency response systems, linking businesses for commerce and trade, and enabling seamless government operations at all levels.
Any destruction of these cables, whether through careless excavation, lack of coordination with telecom operators or deliberate sabotage, directly endangers national security, undermines economic stability and compromises public safety, the organisations warned, painting a grim picture of the cascading effects of even brief network outages on hospitals, financial institutions and security agencies nationwide.
Under the Designation and Protection of Critical National Information Infrastructure (CNII) Order 2024, telecommunication fibre infrastructure has been officially classified as Critical National Information Infrastructure, making any damage from unauthorised digging, construction activities or failure to collaborate with relevant authorities a clear-cut criminal offence punishable under existing statutes.
Individuals, private construction companies and even government contractors found culpable will face immediate prosecution and stiff sanctions as stipulated in the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, with the agencies vowing zero tolerance for what they termed economic sabotage disguised as construction mishaps.
“Future damage to fibre optic infrastructure caused by excavation, road construction or any civil engineering activity conducted without due consultation or collaboration with network operators and relevant regulators will attract strict legal consequences,” the NCC and NSCDC declared categorically, underscoring their resolve to safeguard this vital ecosystem through heightened enforcement.
To forestall further incidents, the agencies implored federal, state and local government bodies, road construction firms, utility service providers and private property developers to adopt proactive measures including thorough pre-construction verification of underground fibre routes using approved mapping tools, early collaboration with the NCC, telecom operators and NSCDC both before and during project execution, strict adherence to national guidelines on excavation procedures and right-of-way management, and prompt reporting of any accidental damage to facilitate swift repairs and minimise downtime.
They emphasised that these steps represent the bare minimum for compliance in an era where digital connectivity is non-negotiable for Nigeria’s progress.
Members of the public have also been enlisted in this protection drive, with calls to report suspected sabotage, vandalism or unintended damage to fibre optic installations at the nearest NSCDC office, via email to [email protected] or [email protected], or by dialling the toll-free line 622 for immediate action.
This collaborative approach, the agencies believe, will not only deter would-be offenders but also foster a culture of accountability among all stakeholders handling earth-moving equipment or infrastructure projects in a country racing towards full digital transformation.
Google has flung open applications for its landmark 10th cohort of the Startups Accelerator Africa, doubling down on nearly a decade of continent-wide tech propulsion by targeting Series A pioneers wielding AI and machine learning for scientific and societal moonshots.
The 12-week “AI First” hybrid bootcamp, kicking off April 2026, equips Africa-based or Africa-centric innovators with Google’s AI arsenal, expert mentorship, technical firepower, and investor matchmaking to catapult health and deep-tech ventures into orbit—deadline March 18 at g.co/acceleratorafrica.
“Africa’s tech landscape is seeing a vibrant shift toward deep-tech innovation,” proclaimed Folarin Aiyegbusi, Head of Startup Ecosystem, Africa. “For Class 10, we are focusing on the potential of AI to drive health and societal benefits, providing the infrastructure and expertise to turn these startups into the research labs of the continent.”
Since 2018, the accelerator has turbocharged 180+ startups across 17 nations, unlocking $350 million in funding and 3,700 direct jobs, cementing Google’s role as Africa’s AI innovation forge amid a deluge of homegrown problem-solvers.
Equity-free and hybrid-powered, Class 10 promises Google’s product credits, strategic war rooms, and global networks to forge the next wave of African AI trailblazers reshaping everything from disease detection to climate resilience.
Firm Reviews the Evolution of Phishing Threats in 2025
EdTech Platform Unveils over 5,000 Self-Paced Courses for Skills, Knowledge, and Literacy
Incentives alone won’t win over Africa’s next billion fintech users — Kuda MFB MD
MTN Guns for $2.76bn IHS Towers Buyout in African Telecom Power Grab
NCC, NSCDC Warn Construction Firms Against Damaging Fibre Optic Cables
19 Nigerian Banks Meet CBN Recapitalization Targets Ahead of March Deadline
Youth Talent Takes Center Stage as T2 Ignites High-Octane Rap Battles @ Carnival Calabar
Aig-Imoukhuede Foundation Wrapped Up 2025 with Real Change in Governance, Health, Media Across Africa
Nigerian Terra Industries Secures $11.8m for Expansion
US invests $115m in counter-drone tech for World Cup security
News2 days agoNew Study Reveals How Moniepoint Powers Nigeria’s Downstream Oil Sector with Same-Day Settlements and Working Capital Boost
E-Business3 days agoOADC Lagos Reinforces Commitment to Local Data Hosting and Digital Transformation @ NDPC’s National Privacy Week Summit
Telecom3 days agoMTN Powers 6,000 Young SMEs with Digital Skills in Economic Backbone Boost
News3 days agoFG Mandates Shared Funding for N1.98trn Electricity Subsidy
News3 days agoSpain Bars Under-16s from Social Media in Digital Safety Crackdown
Telecom3 days agoOnafriq, PAPSS Launch Wallet-Based Payments Pilot from Nigeria to Ghana
E-Financial3 days agoFG Signs MoU with ICAN, CIBN, Others to Train 10m Nigerians in Financial Literacy
General News3 days agoCorporate Comms in the Age of Crypto: Why Nigeria’s Digital Finance Future Depends on Trust