Threat actors are using legitimate corporate contact forms to send phishing emails that threaten enterprise targets with lawsuits and attempt to infect them with the IcedID info-stealing malware. Microsoft analysts observed an influx of contact form emails targeted at enterprises by means of abusing companies contact forms. The recipients are told to click on an embedded link to review the attackers’ “evidence”” but are instead redirected to a Google Sites-hosted website used to deliver the malware. This phishing campaign seems to have found a way to bypass contact forms’ CAPTCHA protection to flood enterprises with a barrage of phishing messages.”
Source: https://www.bleepingcomputer.com/news/security/attackers-deliver-legal-threats-icedid-malware-via-contact-forms/