Executive Summary
A high-severity phishing campaign has been identified targeting a multinational law firm by abusing Google Forms' legitimate infrastructure. The attack leverages the '/edit?invite=' permission escalation parameter, which grants editor privileges to a form without requiring the recipient to sign in. This allows attackers to bypass standard Secure Email Gateways (SEGs) because the emails are fully authenticated via SPF, DKIM, and DMARC through Google's own servers.
The campaign uses a highly targeted social engineering tactic where the sender's display name is spoofed to match the recipient's name, creating a false sense of familiarity. The phishing pretext involves a Hebrew-language survey regarding property tax rights and apartment ownership, specifically tailored to the professional context of the target. This combination of platform abuse and precision targeting makes the attack particularly difficult to detect through traditional infrastructure-based reputation checks.