Nothing to Block: A 1990s Domain and a Google Form

**Authenticated account-takeover spearphish using Google Forms:** An attacker operated from a compromised, long-established business mailbox to send an unbranded payment-notice lure containing a Google Forms shortlink that collected credentials; message content and behavior (no attachment, first-time sender, internal contradictions, missing amount) led Adaptive AI to score it as credential theft (83%). IOCs include the forms.gle shortlink and the Google Forms landing URL, and the case highlights how valid authentication and reputable hosting can be abused to bypass artifact-based defenses.