Attackers are using Google Forms – a free tool typically used for surveys – to trigger automated confirmation emails.