My company started with mandatory cybersecurity trainings for all employees. The training tool sends out automated emails to remind you when you have to do a new part of the training.
These emails, from a cybersecurity course, followed all the rules of being a phishing email:
- Sent from a non-company server
- Had a big red button to click here
- Urged you to take action (“You have 5 days to complete your training”)
IT decided to fix that, by adding a line to the emails that this email is really from our company. Like a phisher wouldn’t think of saying “nah, trust me bro, I’m totally legit”
My company sends out these kids of phishing scam test emails too. They were actually pretty decently faked. But, they use the same identifying string in the header of each and every one, so I made an outlook rule to quarantine them In a particular folder so that I could correctly report all of them. Occasionally I report the weird legitimate email surveys we get from HR too and mass emails from IT with bad spelling, just so they don’t get suspicious of my perfect record.
That’s what always kills me… the line of “this is not a phishing email” as if just anyone can’t add that. If anything that line makes me more suspicious.
They could send an email from a legit company email stating “mail XXX will send you some legit emails in a week or so, do them.”
I blocked these emails for years for this reason. We actually do get real phishing attempts about once every other month when a client gets compromised. Makes everyone at our company very vigilant.
Management got pissed when I hadn’t done any of them. Apparently, the emails in english/spanish/french with “click me” links were legit, lol. I set up extensive rules and blocklists for a reason. Pretty sure it’s for SOC2 compliance or something.
Had this at a previous company. Why didn’t they just use their regula URL instead of “(company)university.com” I don’t know. Reported as fishing
Then both the csec course failed to educate the employees, because a responsible trained employee would report or ignore those mails lol
The emails were mass reported, up to the point there was an internal message sent around to stop reporting them because they are legitimate. Of course, no action was taken to make them look less suspicious.
If I’d ever want to phish someone at my company, I’d know exactly what to do. Make the email look exactly like the training ones.
The correct solution to this is to have the training emails say to log in to take the training, no link in the email at all
A better way would be to have the link be to the company’s webserver which could then redirect to the external course.
I offered to set this up for my company (it’s not that hard) but nah, they went with telling everyone to click on a link to an unfamiliar site to learn about why they shouldn’t click on links to unfamiliar sites.
My company unfortunately uses Microsoft 365 and when they started setting that up, I got an e-mail from a microsoftonline.com domain, which asked me to enter my username and password.
I reported that mail immediately as phishing. Like, it used the ol’ confusing domain trick and everything, it’s gotta be phishing.
Turns out, nope, Microsoft legitimately operates that domain and uses it for account notifications of all things. Great job, guys.
I emailed my IT team when I saw something suspect (which was a phish test), and they said “good job, but in the future click the link we insert in the email body to report”
Hmm…actually, I’d rather not click anything in a dodgy email, thanks.
And now you’ve passed the second test. Don’t trust links in dodgy emails.
Yes. It’s a legitimate inserted banner that goes on every inbound. It just blew my mind a bit that the correct action was to click a link in an email!
This same thing happened at my company recently. We get tons of phishing and scam emails, and then one day another one shows up out of the blue with a very suspicious subject line, so I ignore it. IT guy had to jump on a meeting with the whole office the next morning to explain that yes it is a legit email so please stop reporting it and also please complete the training by clicking the link inside the email.
Like, I feel like if you send your “training” email to people in the form of a well-known phishing scam email, there’s no need to ensure that they follow up with the training, because either they are tricked by the subject line and then directed to complete the email safety awareness training (presumably you would know who clicked on it to make sure they actually do complete it), or they’re intelligent enough to not click on it in the first place and thus already computer-literate enough to not get scammed by obvious bullshittery.
Unsolicited Email is Unsolicited
Simple as