The cloud is making life easier for us all, but it’s also making it easier for phishing attacks to take place, according to a recent Commtouch report. Cybercriminals are apparently utilizing cloud-based form services to reduce the amount of ‘work’ they need to handle in context to fake or hijacked online forms.

“With this technique, the phisher does not have to worry about creating/managing/storing back-end form data and can more easily scale the harvesting of phished data. Those duped into filling out the form will not be aware of this nuance.”

Among the cloud services highlighted are Google Docs and formbuddy.com. Formbuddy is a document and e-mail hosting service maintained and started in 2000 by one called ‘Ajay R’, and was utilizing by a particular phisher targeting HomeAway holiday rentals, according to Commtouch’s blog post. The data submitted was (or perhaps still is) not collected directly, but is instead being sent to a formbuddy.com account with the login name “fanek.”

On the same note, other innocent cloud-based form management services such as OCR Document Management and Berry Forms may also be vulnerable – similarly to hijakced freely hosted sites containing hidden phishing pages.

Security concerns are the biggest drivers deterring enterprises away from the cloud, and they are just as present in the personal cloud, where convenience can come at a price. This is why encryption is so important on the consumer level, while more and more enterprise cloud management features – powered by surging demand in both spaces – work their way down to consumers.

Commtouch has highlighted a few trends around cloud phishing, particularly over the past holiday season. These included the 30% decline in spam noted around December, and the spike in activity followed by the end of the global holiday season – spammers got back to work, and now they’re using the cloud as well as anybody.