Google Forms Display Name Impersonation Phishing - Sender Matches Recipient

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects incoming emails originating from Google infrastructure (Gmail or Google Forms) where the sender's display name closely matches the recipient's local username part. This heuristic is commonly used to identify targeted spearphishing campaigns where attackers impersonate internal users or trusted entities via abuse of legitimate Google services.