FileCatalyst is a trusted brand. Attackers clone the user interface (UI) of the login page. They copy the CSS, the logos, and the layout. When Sarah clicked the link, she didn't see a generic Google Form; she saw a tool she recognized and trusted.
This was not a malware download. It was a "Man-in-the-Middle" credential harvesting attack. filecatalyst+phishing
To avoid becoming Sarah in this story, implement these defenses: FileCatalyst is a trusted brand
To avoid falling victim to FileCatalyst phishing attacks: filecatalyst+phishing