My company started with mandatory cybersecurity trainings for all employees. The training tool sends out automated emails to remind you when you have to do a new part of the training.
These emails, from a cybersecurity course, followed all the rules of being a phishing email:
- Sent from a non-company server
- Had a big red button to click here
- Urged you to take action (“You have 5 days to complete your training”)
IT decided to fix that, by adding a line to the emails that this email is really from our company. Like a phisher wouldn’t think of saying “nah, trust me bro, I’m totally legit”
That’s what always kills me… the line of “this is not a phishing email” as if just anyone can’t add that. If anything that line makes me more suspicious.
They could send an email from a legit company email stating “mail XXX will send you some legit emails in a week or so, do them.”
That’s what my company finally did, it works out a LOT better for everyone.
My company sends out these kids of phishing scam test emails too. They were actually pretty decently faked. But, they use the same identifying string in the header of each and every one, so I made an outlook rule to quarantine them In a particular folder so that I could correctly report all of them. Occasionally I report the weird legitimate email surveys we get from HR too and mass emails from IT with bad spelling, just so they don’t get suspicious of my perfect record.
My company unfortunately uses Microsoft 365 and when they started setting that up, I got an e-mail from a
microsoftonline.comdomain, which asked me to enter my username and password.
I reported that mail immediately as phishing. Like, it used the ol’ confusing domain trick and everything, it’s gotta be phishing.Turns out, nope, Microsoft legitimately operates that domain and uses it for account notifications of all things. Great job, guys.
Yeah you’d think a company could forward from their own domain or something, but I get a ton of legit emails from non company domains because I guess they’re to lazy/too much effort? Anyway, I just try not to click any email links.
I blocked these emails for years for this reason. We actually do get real phishing attempts about once every other month when a client gets compromised. Makes everyone at our company very vigilant.
Management got pissed when I hadn’t done any of them. Apparently, the emails in english/spanish/french with “click me” links were legit, lol. I set up extensive rules and blocklists for a reason. Pretty sure it’s for SOC2 compliance or something.
We had something like this too. The header had our company’s logo as just a rectangular white picture. It looked like someone just copy/pasted the first result on Google images.
Then both the csec course failed to educate the employees, because a responsible trained employee would report or ignore those mails lol
The emails were mass reported, up to the point there was an internal message sent around to stop reporting them because they are legitimate. Of course, no action was taken to make them look less suspicious.
If I’d ever want to phish someone at my company, I’d know exactly what to do. Make the email look exactly like the training ones.
The correct solution to this is to have the training emails say to log in to take the training, no link in the email at all
A better way would be to have the link be to the company’s webserver which could then redirect to the external course.
I offered to set this up for my company (it’s not that hard) but nah, they went with telling everyone to click on a link to an unfamiliar site to learn about why they shouldn’t click on links to unfamiliar sites.
Then you are still trusting people to hover the link before clicking which from what I’ve seen isn’t the best. Though there is the added benefit of using this as additional training to hover…
Had this at a previous company. Why didn’t they just use their regula URL instead of “(company)university.com” I don’t know. Reported as fishing
I emailed my IT team when I saw something suspect (which was a phish test), and they said “good job, but in the future click the link we insert in the email body to report”
Hmm…actually, I’d rather not click anything in a dodgy email, thanks.
And now you’ve passed the second test. Don’t trust links in dodgy emails.
The lesson was “don’t trust anybody, not even your own IT team”
Especially your own IT team.
Do they mean a banner in the message with a report suspicious link?
Yes. It’s a legitimate inserted banner that goes on every inbound. It just blew my mind a bit that the correct action was to click a link in an email!
Thanks to microsofts excellent design team they will be hiding buttons in the bar in outlook new so most vendors are moving to banners with actions.
Users in my org will fail the test email and then report the email telling them they failed 🤷♂️
Clever girl
This same thing happened at my company recently. We get tons of phishing and scam emails, and then one day another one shows up out of the blue with a very suspicious subject line, so I ignore it. IT guy had to jump on a meeting with the whole office the next morning to explain that yes it is a legit email so please stop reporting it and also please complete the training by clicking the link inside the email.
Like, I feel like if you send your “training” email to people in the form of a well-known phishing scam email, there’s no need to ensure that they follow up with the training, because either they are tricked by the subject line and then directed to complete the email safety awareness training (presumably you would know who clicked on it to make sure they actually do complete it), or they’re intelligent enough to not click on it in the first place and thus already computer-literate enough to not get scammed by obvious bullshittery.
Sounds like a genius move if he didn’t then fuck it up by the meeting thing.
My company sends fake phishing mails and once you open the link it says “you’re lucky, this was just a test” and you get tons of new fakes. I think I never got a mail from outside tho I didn’t click all so who knows
Yeah okay but our company IT dept sent out a security training link in an email titled “Win a free cruise!!!” None of us clicked on it it’s like you tell us not to open emails like this, but you send an email like this in order to train us not to open emails like this.
It’s targeted to those who need the training.
But it was a mandatory training!
I work in corporate IT and I can guarantee that no one in the IT department gives a rats arse if you do the training or not. It’s management that care.
Says a lot about how highly your IT department thought of the employees if they communicated mandatory training that way. They expected a 100% of staff “gets fooled by obvious-sounding phishing spam”.
Unsolicited Email is Unsolicited
Simple as
That’s how you get signed up for remedial security training.
Serious question. Why have a combination of operating system and email system that even allows this problem to exist at all?
It’s like, what if stepping on a crack really did break your mother’s back? Wouldn’t we just build seamless sidewalks instead of constantly reminding every sidewalk user to not step on all the cracks everywhere?
