They don't track false positives?

Those should be validated external senders and links, else they are spam or phishing by default.

Heh, an employee at my work got an email saying his anti-malware was failing to update, and to run http://10.3.4.2/xbejdjr.exe and that they need to click allow when the browser warns them that it is rejected, then right click, run as administrator, and they need to click allow in two other places to let it run.

So he reported as phishing, then IT contacted his manager saying he was failing to help IT run a required update, it was evidently totally legit, but just the most scammy looking way they imagined.

Do we work in the same company?

You work for GSK don't you

My company used some security software that scrambled up every url in emails.

You could've spotted their fake meeting invite if only it would have shown its true url.

I tried to make the case to IT that hyperlinks are not a threat vector on their own. They should train against opening attachments and entering credentials once the link is clicked. I haven’t heard back yet, I’m not sure they liked my message. But they did send a message letting us all know that reporting non-phishing surveys wastes their time.

Same. I saved it to add to our KnowBe4 templates

The issue is that people's egos get bruised when they fall for it, and they'll very quickly get management on their side that certain ones are unfair, as if phishers give a shit about fair.

What I really love is how my workplace uses some man in the middle crap to replace every link in every email with a new one redirected through our cyber security link scanning product, so now there's no way to check the actual link before you click it since they're all just like garbagesec.com/4a12c89e7f now.

PFF I don't click on any training emails unless my manager is asking about it in person.

If it's not important enough for them to follow up on, it's not important.

My org has us do the standard phishing training and then sends out completely legit links that ring all the alarm bells. Lots of survey links coming from whatever random domains they found to host it. Links to official applications that ask for to many permissions and are shady as fuck. Its surprising we don't get got more often.

I remember those paper schemes!!! If everyone just sends money around it will multiply and you can make millions! I got one and tracked down some of the people on the list to see how much they got. I was 17 and just heading to college at the time.

Yeah, I used to see these when I worked at a big corp. I would do a whois search on the domains used and 9/10 times it would come back as some compliance contractor the company used. I then proceeded to roll my rolly chair up and down every aisle warning my engineers. I spent so much time rolling in that job they should have bought me a rascal scooter with a built in desk. :D

We once had one that had what looked like a user ID in the URL. Checked with a coworker. The IDs appeared to be given sequentially. So I copied the URL and visited the site many times with different IDs.

A lot of people failed the phishing test that month and would deny it.

That is exactly how I phish (ha) them out as they hit my inbox!

Real phishing mails won't.

You guys are making pastries without me?

I'd always pass because I never look at any of my emails. Checkmate, IT department

Work in IT and my old cyber security architect would always try to get us. He did some great tricks and got a few salesmen. Never the engineers. Then they did similar tests for clients, they got hammered bad.

I had a previous company send out a company wide announcement from a sketchy sender with a weird file attachment(apparently it's a voice mail file format), and the email was essentially listen to this attachment with no signature or anything else. They had to send out a second email explaining the suspicious email is actually real. Companies seem intent on ensuring there is minimal difference between phishing and legitimate email.

Honestly, this is preferable, and pretty funny. IT can always resend invites to tools and services. I'd rather send 1000 of those than have to lock someone out and have to talk to a human.

Depending on what they’re testing for, you may still be a fail in the statistics. For example in my company we have a button to report phishing attempts, if you fail to report the email you fail.

This email is the phishing attempt test itself. It says you are exempt from the phishing testing, but then tells you to put your account information on a random website.

I think the implication is that this is the fishing attempt they sent this to the higher ups / IT staff and got bites.

The email is a phishing test, and clicking the link automatically enrolls you in mandatory rudimentary cybersecurity awareness training.

Tell your relatives that this IS the phishing test email. If you click that link, you're gonna get busted by your IT department.

Never click links (or for that matter, ads) in emails. Always verify the sender first. Not the display name, the actual email address that it was sent from.

If you must go to a link, best to find out what website they're sending you to (hover over the link for the URL), then type in the main website manually from a web browser.

For example, if you get an email from US Bank (assuming you use them), type "usbank.com" (minus quotation marks) in your browser, then login to your personal bank account on their official website. Don't trust a link to a bank's website without typing it yourself. Don't just copy/paste the full URL from your email either.

Some links, even to legitimate websites, can have tracking data in the URL that gives a lot of info about you, where in the world you're browsing from, what web browser you're using, what website, app, or program you clicked the link from, etc. Basically, remove the "&" and everything after it in URLs before loading them in your browser.

These are just a few basics to protect yourself from malicious links. Basically, don't click any link you don't recognize and verify with people who send you links. And even then, protect yourself from idiots who forward links without doing their own spot checks. Even your best friends can send you viruses and malware. Heck, that's how a lot of it spreads across the Internet.

And especially don't trust your own IT department when they ask you to click links in their emails.

Sincerely,

~A former IT guy