Cybercriminals often use legitimate services such as Google Forms and Telegram to obtain user data stolen on phishing websites to help keep it safe and start using the information immediately.
Source: cyware.com