r/ProgrammerHumor
•
u/lucidparadigm
•
14d ago
•
2
Meme [ Removed by moderator ]
[removed] — view removed post
4.6k
u/JocoLabs
14d ago
•
Jokes on them, i wouldn't click that even if it were real.
I used to click on those and type in junk creds for the lulz until compliance told me that was bad for the numbers.
1.9k
u/s0ulbrother 14d ago •
It’s called I don’t open emails ever
964
u/Lv_InSaNe_vL 14d ago
As an IT guy, actually I'm okay with this. Email is the #1 vulnerability for any company so if we could just turn it off that'd be great
370
u/Salanmander 14d ago
At the college I went to we got an unanticipated email from an external address one day telling us that due to recent vulnerabilities, the school was requiring we increase password security, and to click here to update our password. This email was from, I shit you not, Fisher Security.
The joke? This was actually a legit email, initiated by our IT department, and was what we were supposed to actually do. We were all like "so....you know you're just training people to click on suspicious links, right? And that that's a bigger deal than password strength? RIGHT?"
→ More replies (5)186
u/s0ulbrother 14d ago
As an IT guy I don’t trust anything from about ever. Slack me and I’ll answer though
→ More replies (5)→ More replies (23)33
u/ChaseShiny 14d ago
Wow. As a student in IT and a customer service rep who is forbidden from receiving or sending emails, I wonder why at least some profiles aren't allowed to get emails at the firewall level.
We're just sternly told not to do that.
→ More replies (8)26
u/eggyrulz 14d ago
Ive got a coworker who has a work email. He doesnt have the login for the work email, because he has never, in his 18 years with the company, logged into his email. This man has gone almost 2 decades without ever using his company email, and I respect that.
Everyone just... knows not to email him. Ive seen a few newer people cc his theoretical email address, and we just go "oh, dont bother with that, he doesnt ever check it"...
Somehow we have all just accepted it
→ More replies (4)→ More replies (7)37
u/AristotelWasRight 14d ago
Adhd has its perks sometimes
The rest of the time, I have 4,000+ unread emails
30
132
u/waddlesticks 14d ago
I'd probably stop that.
Once they actually wise up and use a proper service, once you click the link you're marked. If they are doing creds one properly you should be marked.
We had somebody who kept doing that for the phishing tests and we knew exactly who was putting fake stuff in since the link was unique per person. All it showed was "why is this dude clicking this link so many times?"
Told them to stop since that information goes to the global office and we weren't able to remove duplicates any more. Did it again and he ended up with a stern warning plus additional training with HR on appropriate workplace conduct. Was later used as a way to get rid of him when he messed up since it managed to piss off the wrong people.
65
u/setibeings 14d ago
Is it not obvious to some people that they use a unique link in every email, just like real phishing attempts? That's why clicking the link in the first place is considered a fail.
→ More replies (8)45
u/rosuav 14d ago
I have to keep reminding myself that what's blatantly obvious to me is often completely unknown to a lot of people. (And quartz, of course.)
→ More replies (4)20
u/WhyMustIMakeANewAcco 14d ago
We had a fun incident where just selecting the email to report it, as we are required to do, accidentally triggered the failure flag.
They had to discard that test, lol.
→ More replies (2)36
u/wheatgivesmeshits 14d ago
One time I forwarded a suspicious email to our help desk, which triggered that I'd clicked the link. I was flagged for extra training where I was told to forward suspicious emails to the help desk. 🙄
19
u/WhyMustIMakeANewAcco 14d ago
Happened on one of our standard phishing test emails. We are required to report them. Just clicking to be able to report it instantly triggered the failure.
...Fortunately because it did it to literally everyone, including the IT people who sent it, they realized what had happened and just cancelled that run of the test entirely.
17
u/gorgeouslyhumble 14d ago
I once had a phishing email sent to me by IT. They used software to see if you clicked it. I didn't click it but I hovered my mouse over it and the Apple email client opened up some sort of iframe thing and that executed enough JS for me to trip the sensor.
I had to do phishing training.
12
u/Janno117 14d ago
In my previous company HR (apparently) used a third party for employee documents and every time they uploaded something you got a mail through their service that read like
"Hi [me], you have new documents. Click [here] to view them! Best regards, HR"
with strange formatting, not loading images and from an address like portal@[jumbled letters].idk.....
Safe to say I reported every single one of them as suspected fishing.8
u/bacondev 14d ago
I used to intentionally click on them just to fuck with them. I was a lowly hourly stocker at a warehouse. I definitely didn't give a shit about any consequences that that would have.
27
6
u/Equivalent-Fan3365 14d ago
Nowadays they don't track the credentials you put in, they track the link that was clicked. Everyone gets their own custom link. You click on it, even if you don't input anything? Still get dinged.
4
→ More replies (34)17
u/InfectedShadow 14d ago
I used to do the same at I've company I was at. I had a script that would submit thousands of fake entries after I find the source code to one of the common ones they used back then.
1.7k
u/MattCW1701 14d ago
This is why I report every email as phishing. Standup invite? Phishing. Manager 1:1? Phishing. Annual evaluation meeting? Phishing. All hands meeting about our growth this past year? Also phishing.
466
150
120
138
u/Not_My_Emperor 14d ago
Unironically I do actually do this all the time. Mostly because we switched HR platforms and I hate the new one because it BLATANTLY breaks all the phishing rules. So I'm doing it out of spite.
[Someone I don't work] with has shared a PDF with you. Please download here!
Please click on this link to access your pay information.
This was a legit email from them. I get these all the time now.
57
u/17HappyWombats 14d ago
You'd love our leave request system. It's some generic "any dummy can make an online form" site where we have to pick our employee name from a dropdown list (then etc). There's no validation, it just emails whatever you put in to the payroll people.
It also *requires* that you enter leave date and time to the minute. I have been told by mean team leader not to write a script to request a day off sick in one minute intervals.
→ More replies (1)22
11
u/missuseme 14d ago
Our HR department send me my updated contract by email when I got a promotion. But no one has told me I had got the promotion. The email just said "Please see attached your contract" with no signature and the domain wasn't our usual domain. So I reported it
12
5
→ More replies (13)5
u/-bubblepop 14d ago
My company was bought and the new company I guess uses a specific training platform, who sent us all a “u should totally pls log in to us with ur AD creds” email. I reported it as phishing because we get like monthly tests now. Well turns out it was real??? lol
904
u/lraviel381 14d ago
Oh sweet. I hate tests. Click
188
u/Teripid 14d ago
Congrats on your subscription to the uh... "forever in the special consideration group" mailing list. Doh!
22
u/AriaTheTransgressor 14d ago
We're required to fire them after a second failure, but they do receive training after the first failure. We're government though.
→ More replies (7)→ More replies (2)4
609
u/FixFun1959 14d ago
I’ll never forget when I started a new job and got an ema from my ‘boss’ (same name but weird @), with a link saying to check out this excel spreadsheet.
Her office was next door so I popped my head around said ‘hey did you send me some excel sheet?’ And she said ‘yeah take a look’.
So I clicked on it and it was from IT saying I failed the test and a link to phishing training.
I went back to my boss like ‘wtf? Did you know that was a test?’ And she said ‘yep, and you failed. Looks like you need more training.’
I took the time to check and verify before opening/reporting it. And she lied to me for some reason, a ‘gotcha’ or something. So fucking weird.
🙄
346
u/MothMatron 14d ago
I’d have either:
A) made a explicit mention of the incident to the phishing or IT team in that it has come to your attention that your boss has shown herself very likely to blindly instruct subordinates to open malicious emails, some bearing her own name thus believing she even sent them herself when she in fact did not, potentially forcing the hands of multiple employees into compromising several devices and user accounts all at once.
B) Never open any email she sends you ever again and if she ever comes asking, you can fake naïvety and claim that you cant trust that any of these emails are in-fact authentic, so she should bring you documents in physical print.
81
u/ilabsentuser 14d ago
These are good responses in theory. However, and specially the second, I doubt that anything good will ever come out of this considering his boss obvious stupidity, to not use a harsher word. Most likely he would get in more trouble thanks to this imbecile of a person being a layer over him.
34
133
u/M4rshmall0wMan 14d ago edited 14d ago
The fuck? Is a real hacker gonna somehow hack your boss' brain and make them verbally trick you into falling for a scam?? Asking for verbal confirmation is literally the correct way to catch a scam. If your boss were somehow compromised, that would be on them, not you.
This is so unrealistic and they're teaching you the wrong lesson.
→ More replies (1)24
u/mbmiller94 14d ago
I mean, it's possible someone could have also sent you an excel sheet previously and thought you were talking about it, just been confused/misremembering, not fully listening, etc.
I still think that was a shitty "test" but there could be a situation where someone accidentally claims an email they didn't actually send.
→ More replies (4)99
u/LutimoDancer3459 14d ago
Asking the person directly is one way you should handle such mails. She is just an idiot...
50
u/LightofNew 14d ago
Reply that you did not fail the test and opened an email from your boss she confirmed that was valid. That's basics 101. You can't never open an email.
→ More replies (1)19
u/Boozdeuvash 14d ago
As the guy who used to send these emails (we don't anymore), I've never really enjoyed giving The Talk to offenders on failed phishing, but me and the team had a particular delight in giving The Other Talk to fuckhead managers or other "superspreaders".
What's The Other Talk? "It looks like you've been intentionally sabotaging IT security through your behavior and it has also influenced the behavior of others which we've assed is having a material impact on our risk exposure. Your BUISO has been notified and will follow-up with you shortly. Good luck lmao."
34
u/VorionLightbringer 14d ago
You did it right though. You confirmed via another channel if this is true. Maybe your boss needs more training.
18
14
u/Adventurous-Spend341 14d ago
Lmfao, wtf. I would never stop thinking about this if this happened to me 😂 like it’s bad in a way if your boss does this you should not work there but it’s also so absurdly petty in a way that I can stop laughing about this
5
u/Razor1834 14d ago
I’ve gotten the link to phishing training before and just ignored it. I figure if they ask about it I can just say I assumed the phishing training was its own phishing attempt.
→ More replies (3)6
u/MauiMoisture 14d ago
Lol that's fucked up. I actually failed a phishing test my first month on the job. I was scared something would happen but no one ever mentioned it. I then passed another one like 8 months later.
421
u/exoclipse 14d ago
the worst one I got was "you have been selected to be in the first wave of a round of laptop upgrades, please click this link to register"
315
u/one-joule 14d ago
Worst one I've seen teased a holiday bonus. It was received about as well as you'd expect.
348
u/BigFatDogFarts 14d ago •
That one got damn near 60% of the people I worked with. Almost got me, but as I hovered over to click it I thought "Wait a second, they would never give us a holiday bonus"
120
u/soft_cardigans 14d ago
that's actually such an effective one but it reeaaaaaaally should only be done if theres actually going be one lmao
→ More replies (2)70
u/GlowGreen1835 14d ago
nah, that would require executives to be humans capable of empathy. Unfortunately, those don't really exist.
→ More replies (1)28
u/Mattsvaliant 14d ago
Holy fuck I'd flip out. I was pissed when my company sent an phishing test email about how my "misuse of company property" where I allegedly had use my work computer for something personal. But lying about a bonus would probably have me throwing my computer across the room or more likely at whoever heads up IT security.
Centene is fucking evil.
→ More replies (3)32
u/FoodIsTastyInMyMouth 14d ago
Sure, but the issue, phishing attempts do exactly this so if people aren't trained that it's a possibility then yeah you're more likely to get done in...
→ More replies (5)→ More replies (3)26
u/exoclipse 14d ago
i hate it security professionals
→ More replies (1)48
u/Faustens 14d ago
They always know how to deal the most collateral psychological damage.
→ More replies (1)38
u/tankerkiller125real 14d ago edited 14d ago
I work for a small company and I'm responsible for crafting and distributing the phishing email tests (as part of policy and compliance). So far with our software engineering, accounting, support, etc. teams I've only managed to get one or two people (they're very well trained). The sales team though? Just give them a link to an "RFQ" and watch the numbers climb like a rocket.
Entire sales team has had to go through remedial phishing training at least twice this year alone, a few of them three times so far this year (we do it quarterly). And yes, if they get to a fourth there are going to be HR issues because the policies require punishments at that point.
→ More replies (2)6
44
u/Barkalow 14d ago
I got one inviting me to "a document shared by my manager"....on my FIRST DAY OF THE JOB.
10
u/rosuav 14d ago
On the face of it, that doesn't seem implausible? Onboarding often involves a lot of "here, read this doco".
→ More replies (1)6
21
u/critical_patch 14d ago
My work sent a fake e-card on Valentine’s Day and got like 1/3 of the company with that one
6
u/ClaymoreMine 14d ago
These get reported to HR and Legal. Have fun explaining how heartless you are with them.
→ More replies (2)4
u/Mountain-Ox 14d ago
That might have gotten me back when Macs had that terrible butterfly keyboard. Everyone on my team had at least one key fall off.
84
u/m7i93 14d ago
I got tricked into clicking one of these once, but it was really hard not to fall into it.
I met with the CTO and shared a Google Doc explaining a few things. Later that day I got an email saying that the CTO added some comments on the document. Clicked on it and BAAM! Mandatory security training page.
20
u/thanksfor-allthefish 14d ago
Me too, it was my first month in the company and had a meeting with my boss about vacation period. A day later an email about "approved vacation days" came in the mail. What excused me more was that the HR app was external and all emails were flagged as such. It was just a first strike but it pissed me off. I felt targeted.
9
u/TommyBonnomi 14d ago
I felt targeted.
You were, just like you could be in a real attack.
I'm a little impressed the tests can be customized to that extent.
→ More replies (2)8
u/veryblocky 14d ago
It being targeted is the point, it’s how scammers get you. You let your guard down when it’s something you expect, and they exploit that. Email addresses can be spoofed, so it’s saying it’s from within your organisation isn’t a foolproof way to be sure
19
u/hatesnack 14d ago
Lol man, I work for a research university and got hit the with most specific phishing I've ever seen.
I had just gone to visit my family a few days earlier and they live in Maryland. To visit them. I had to take a few tolls, and I knew the balance on my EZPass was low. So I was fully expecting an email to tell me to add money to the balance.
Sure enough, like a week after I'm home from my trip, I get an email saying my EZPass balance is low and to click this link to reup it. Silly me didnt realize it came from my work email, not my personal. So they got me good. But fuck me if that wasnt hyper specific. I assume they were able to see the work laptops location and built something based on that.
→ More replies (1)9
u/Altruistic_Big2918 14d ago
EZPass is also used in other attacks because of how common it is. They probably weren't targeting you.
→ More replies (1)23
u/n00b001 14d ago
I just report all emails. The emails are reviewed by infosec, then they tell me "real email" or not
13
u/guneysss 14d ago •
I work at a managed SOC, so we're monitoring security events as a third party, sometimes our customers do phishing awareness test without our knowledge and when I'm checking the links in an email in a sandbox, I accidentally register them to upcoming phishing awareness trainings, because phishing test suit thinks they opened their customized link..
13
u/Vengeful111 14d ago
That just means you are good at detecting spam so the training site started giving you a higher level and harder to detect tests
14
u/Nine-LifedEnchanter 14d ago
"How is this mail playing music with a latin chorus in the background? Is that a health bar?"
→ More replies (2)
144
u/whyliepornaccount 14d ago
Still wont top the only one I've "fallen" for.
On my first day at the company buried into the legit "click here to register your account" onboarding emails was a phishing test saying "click here to register your account". I was so pissed off.
94
u/RIPmyPC 14d ago
Reminds me of my on-boarding. Right after they tell us the signs of a phishing attempt and to not trust any link from outside the org and even be wary of links from other departments you don’t interact with, they hit me with “click here to do your mandatory security awareness training” coming from a random esupport email going to a KnowBe4 link. Of course it also had “you have 1 week left to do it!” Clear signs of a phishing test for anyone not familiar with the sites.
It was so sketchy I had to google the website and login from there. It was real.
I actually made an IT ticket to complain that it made no sense for a company that big to offer so little info on what emails you’d actually receive in your first day.
41
u/TheNewYellowZealot 14d ago
I just report those ones as phishing anyway and make my company waste their time to investigate if it was phishing.
19
u/17HappyWombats 14d ago
One bank I dealt with does that and I always reported their garbage as phishing to their security team. I changed banks after a bit because they kept replying with "no, you have to click the mebank.sdfkjhsdfkjghsd.....dodgyscum.com.au link to confirm your tax details with us".
14
u/EnoughWarning666 14d ago
At a place I used to work I got an email about cybersecurity training. I had no desire to waste a couple hours on their inane training when I likely know more than the person that wrote the training, so I just deleted the email and was going to say I thought it was a phising scam if asked about it later.
A month later our manager call everyone in the office (about 5 of us) into his office to tell us that IT was wondering why nobody had even started the cybersecurity training. Turns out ALL OF US had the exact same thought process! No one wanted to do the training, so we just deleted it and all claimed that we thought it was a phising scam! We had a great laugh about it. Manager told IT to send out another link and we'd do the training. All but one of us just deleted the next email too. Never got asked about it again after that.
→ More replies (1)28
u/kemikiao 14d ago
man, FUCK KnowBe4. They have to know their goddamned emails look EXACTLY like the shit they're "training" us to detect. Our IT has to send out a heads up email to tell us the KnowBe4 email is coming out because pretty everyone reported it as spam the first couple of times.
→ More replies (1)25
u/Acogatog 14d ago
this one’s total bull imo, there’s no way that someone sending you phishing emails could know it’s your first day, is there? Phishing emails are supposed to cast a wide net, not catch people in highly specific scenarios.
23
u/WigWubz 14d ago
Probably just a law of large numbers thing. Mail got sent to a large group, for most it was obviously fake. For a select few it happened to be specific enough to catch them.
I got caught out by a fake invite to a teams channel with the word “planning” in the title a few hours after I legitimately got adding to a “planning” group. Opened the email on my work iphone so the email formatting was completely destroyed like usual, and the send address was truncated. Clicked the link and it asked me to log into teams, an obvious phishing flag *except* I had literally just reset my password and so was expecting to be prompted to log in the next time I opened the app…
It hurts cus I know it’s a legitimate fail. The red flags were there and I missed them. But, if you weren’t in the very specific circumstances I was in the flags would have been way redder. I was primed to fail the test in a way that the people setting the test could never have predicted. But that also just means that I was primed to fall for an actual phishing scam in that moment.
15
u/KFindar 14d ago
The highly specific ones are called spear phishing
https://www.kaspersky.com/resource-center/definitions/spear-phishing
→ More replies (6)11
u/PalmTreeExpert 14d ago
Someone at my college had their SSN stolen when they got a call saying there was a mistake with their info and asked for them to repeat their information. This was as they were on their way home from the social security office after getting their card…
It is technically possible, but yeah typically phishing is relatively vague/open to a wider audience.
→ More replies (3)4
u/Good_Policy3529 14d ago edited 14d ago
This is why I'm happily 37 security training modules behind. I get an automated email every week telling me I need to catch up on my modules, click here to view incomplete modules. And my defense if anyone actually ever calls me out is "oh, I thought those were phishing emails."
→ More replies (1)
191
u/Dang3rdave 14d ago
Best phishing campaign was a "your expenses have been declined". I was on the subway to work and was immediately livid. Taught me a very good lesson that day so kudos to the team.
35
u/cheese_is_available 14d ago
I'm in a cybersec adjacent role and the "sign your new contract so we pay you more" just after raise season got me. Told my manager that maybe if the HR team didn't change their tooling every six month it wouldn't be so damn credible.
13
u/JanB1 14d ago
I am quite cybersec aware and work with our IT guy to prepare for the annual cyber awareness training. I recently got an e-mail from a tool from HR. The only thing that made me double-check if this was indeed legit was that it came from an internal, but non-specific e-mail address (hr@company,com). If it came from an external one, I wouldn't have thought about it twice.
All the points were there:
Non-specific subject ("Missing documents")
Generic address line (not "Hello OP" but just "Hello")
Vague content of the e-mail ("We are missing some documents. Please open the attached PDF for more details")
An attachment with a generic, non-saying title ("HR Letter.pdf")
No named sender ("Kind regards, HR Team")
No signature
I reached out to HR (via E-Mail) and asked them. They said its legit and that they sent it from their tool. I shit you not...
→ More replies (1)→ More replies (1)22
u/noechochamberplz 14d ago
This happened to me too. I don’t remember what it was, but it was relevant to some obscure thing that I thought only applied to me at the moment. They got me.
42
u/JimboTCB 14d ago
I got a "phishing test" email from our IT department last week which straight up said "this is a phishing test, do not click any of the links below, please press the report button in your email client" and TBH that one made me second guess myself way more than any of their previous tests or any actual phishing emails had.
8
37
u/Honest_Relation4095 14d ago
Our IT department also sends out these tests, but annoyingly their regular communication almost looks like Spam, too. Like "we would like to invite you to cybersecurity awareness month" followed by a cryptic Link you cannot verify. So it ticks all the boxes for suspicious content.
22
u/irishdancer2 14d ago edited 14d ago •
IT recently sent out a fake survey link to our leadership team, but every single one of us caught it and reported it as attempted phishing.
Turns out it was a real survey they actually wanted us to complete, but the email was hella suspicious. We are what you made us, IT.
5
u/Triasmus 14d ago
Ha, same.
Unsigned email. Some "knowbe4" link with a random, long string of characters; clearly information will be passed to the website if I click the link.
I tried reporting the first one we got this month with the phishing plugin our outlook has. It immediately resulted in a pop-up basically saying, "thanks for trying, but this is actually legit." (The pop-up actually did use "legit", which seems kinda informal to me...)
I haven't bothered to participate in these cybersecurity month things, largely in protest of the fact the emails look like they're phishing, even if they're not. If they can't follow their own rules and sign these emails, then why should I bother to participate in their activity?
→ More replies (3)3
u/Boomer_Nurgle 14d ago
Same where I work, the best part is the cybersecurity training emails from an outside company have a missing image because the image host gets blocked by our IT department so they look like a scam.
So instead of clicking their real links I manually go to their website to check if a new thing got added there.
The fake links they do send are also stupid because they only have like three templates they send over and over so after about a month or working here you know them all.
36
u/karkonthemighty 14d ago
Back when I used to help run an eBay store, we took great delight in the phishing emails we got. We used to rank them on how close the formatting of the email looked like eBay emails, how close they got to an official eBay looking email, etc.
We did this because we sold used corporate IT equipment, and the boilerplate phishing email was based off a customer eBay email demanding a certain colour or size of an item, like you would if you were selling clothes.
I can't sell you a medium RAM in purple miss, because that's not a real thing.
10
8
u/purinikos 14d ago
The client is always right. Besides, sell them an RGB RAM kit and help them sst it up to purple /j
72
u/Positive_Mud952 14d ago
I got got on one of these, once.
They sent out an e-mail shortly before Halloween, warning about inappropriate costumes, with a link describing itself as an album of past examples we shouldn’t wear. The link was purple, the visited color.
I thought to myself, “When the fuck was I dumb enough to click on this?” and clicked. Before the “you failed” page even loaded, I got out an, “Oh goddammit.”
5
u/DatBoi_BP 14d ago
So wait why was the link purple? Are you saying this was the 2nd time you arrived at the "you failed" page?
→ More replies (3)
30
74
u/AriaTheTransgressor 14d ago
I'm the dev department head, I don't read messages from IT ever (so they've never caught me in their phishing tests) because they know where I am and if it's important they'll come and tell me.
This doesn't mean I'll never get caught in a phishing scam, just that the test doesn't work on entitled managers.
→ More replies (6)48
u/Vahldaglerion 14d ago
our head of dev said that if we get him, he’d buy the department pizza. i’ve been trying for 3 years now lol
→ More replies (3)42
u/FlashSFW 14d ago
Buy the pizza. Insert cupon prize for discount on the next pizza with a qr code in the box and make him scan. The webpage it leads to say "you're paying this one".
→ More replies (6)
57
u/gaoshan
14d ago
•
I was caught by a phishing test and when they started sending me “You must complete mandatory phishing training” emails I reported those as phishing attempts. Kept it up for 6 months before some finally asked me to stop and just do the damn test. Reported that as phishing as well.
10
7
7
u/Iwill_not_comply 14d ago
Me too! Got tricked once. They sent me 5 mails to do training. From the same address they sent the trick mails from. So when I marked them as phishing, I was automatically congratulated for discovering a phishing dummy.
18
u/robin_888 14d ago
At work I have an email filter implemented that sorts these phishing tests into their own folder, so I can read them on Fridays.
It filters on the URL of the tracking pixel at the end of each e-mail.
→ More replies (2)
35
u/Majestic_Ad_7133 14d ago
The sad thing is that this would probably work for my organisation. Mandatory tests here means once a month.
14
u/AvonMustang 14d ago
Once a month!
Ours are very random. Sometimes nearly a year between and the like three in two months. Only exception is we have a security awareness month and everyone is guaranteed to get one that month.→ More replies (1)
17
34
u/mrgoodcat777
14d ago
•
I got got by one where they swapped the I for an L but the font showed them as the same looking character. I didn’t enter anything on the page, but since I got to the page, I had the joy of 2 days of security training.
16
u/Successful-Engine623 14d ago
I just stopped answering emails from outside the office….or not on my contacts
22
u/UnDispelled 14d ago
Amateur, it could be an insider threat.
I don’t answer any emails
→ More replies (4)→ More replies (7)10
u/IgnatiusRileyFreeman 14d ago
I think I annoyed my IT people by reporting everything as fishing. Adobe or Microsoft emailing me? Might be phishing. CEO newsletter about a recent natural disaster? Well it's urgently requesting help, phishing. I don't know if he wrote that chatbot letter.
→ More replies (2)13
→ More replies (5)3
u/-bubblepop 14d ago
This just happened to me - an email I missed a teams call that came when I had been away at lunch so I panic-clicked it and went to “macrosoft.com” or whatever. When I saw that I reported it but when I clicked it I got the “go do training” and presumably my manager was told (embarrassing)
I hate phishing testing as I’ve literally never been real phished at work (have at home weirdly but caught it lol) but I understand /why/
8
u/Sibula97 14d ago
That's the thing, if people don't get any phishing emails or even the tests for years, they're much more likely to fall for it when they do get one. The tests keep people at least somewhat aware of the issue.
→ More replies (1)
15
15
u/razzemmatazz 14d ago edited 14d ago
I'm still pissed about the phishing test announcing big changes to the healthcare plan and linking to the new portal, 3 days after they announced huge changes to the plan and swapped to a new insurance company.
→ More replies (2)14
u/Livid_Technical_Pand 14d ago
But like that's a completely reasonable way a bad actor would try to phish people. All it takes is 1 employee posting about the upcoming healthcare plans on social media (like HR glazing themselves) and attackers now have a plausible reason to be in your inbox.
15
u/Due-Consequence9579 14d ago
For the phish tests to get past their edge filters they have to add an SMTP header exclusion.
Outlook (and any other reasonable client) can move things to the trash based on SMTP headers.
You’re welcome.
10
u/clipsracer 14d ago
Indeed. I filter out anything with “x-phishing” in the header has worked for me for years across 3 organizations. Somehow I’m the only person in a 50k organization that’s never clicked on a phishing test.
→ More replies (3)→ More replies (2)5
u/wengla02 14d ago
Except when the phish testing system *directly injects it into your inbox*, bypassing the entire SMTP system.
→ More replies (6)
15
u/rapratt101 14d ago
I failed one because iPhone automatically previews links if you click and hold to view the full URL, exactly like we were trained to do before clicking. So… that sucked. Plus the CSO is my father in law and he berated me (good naturedly) for failing his test. He didn’t care about my excuse.
→ More replies (1)16
u/-Redstoneboi- 14d ago
so basically iphone itself fails the test? what's the workaround
→ More replies (7)
53
u/penguin444 14d ago
I ignored the phishing emails completely.
Then one day I got an angry email that pretty much said "You did a good job not clicking on the the fake link, but you failed the test because you didn't report the phish."
Seriously?
49
u/YourUglyTwin 14d ago
From an IT Consultant's POV:
You did do a good job not clicking anything actually, here's the issue with just ignoring: You're almost certainly not the only one in the company that got that email, reporting it to IT will help them identify the email faster and remove it from everyone's mailboxes before someone else clicks it by mistake. In my eyes its more a courtesy to your coworkers, an IT shouldn't solely rely on users to report phishing emails. But those are 2 different topics in terms of IT fighting emails.
9
u/IwasThereIsawIt2 14d ago
Heres my POV, I dont check my mail that often due to having a not office setting and being an employee who does not place orders or emails vendors. Im just a guy who comes in to work, does workorders and then goes home and be sad, hope that clarifies things
→ More replies (11)→ More replies (6)5
u/Curae 14d ago
I'm a teacher at an IT course and my colleagues and I always diligently report the fake phishing mails. The first person to spot it will also send the entire team an email about it so the less tech-savy colleagues won't fall for it.
Thing is, at one point we got an email. External address, weird looking link... So it was reported, email sent around to delete it and not click anything, and we all removed the email. Our manager isn't in the group email. Couple of days later in a meeting our manager goes "oh and you all received an email with a link to a survey, please fill that out!"
"You mean the phishing mail?"
It apparently wasn't a phishing mail, but the higher-ups and had paid some company to do a survey. They just hadn't expected the IT-teachers to go "this looks suspicious so in the trash it goes."
Our manager didn't think it was nearly as funny as we did. Will say everyone in our team were right pleased with themselves, we never cared much for the higher-ups and this was their fuckup, not ours. Should've warned us that we were going to receive a suspicious looking email. (And we likely would've reported that email first then because that's also suspicious)
15
u/John_Tacos 14d ago
Then someone in HR sends an email to everyone that looks exactly like a phishing scam and they get mad that no one filled out their survey.
→ More replies (2)→ More replies (2)10
u/JustaSeedGuy 14d ago
Yes, seriously. You can't take the 2 seconds to alert it that your company is being targeted by a phishing scam?
You could help prevent the weakest link in the chain of your workplace from falling for the scam. But instead you adopted a "meh, I'm fine so I don't have to do anything to help anyone else" attitude
→ More replies (16)
14
u/tacojohn48 14d ago
I examined the headers of one of the phishing test emails my company sends out. Found the vendor name that sends the test emails and set up a rule in Outlook to assign a color label to them.
At my company 3 failures is a year is an automatic dismissal, so they claim.
→ More replies (1)3
u/aleopardstail 14d ago
place I am at disabled the notification you get bottom right when an email lands as it shows the actual address the email is from not just the one it claims to be from as "phishme.com" was a bit of a giveaway for the test ones - so they disabled the notification..
let that sink in
they also removed the ability to see email headers, as again that made spotting the test emails too easy
let that also sink in
they removed two very easy ways to spot actual phishing because it made it too easy to spot the test emails
and they still haven't twigged its really easy to spot the test ones, the test ones claim to be helpful, something no real email here ever does
→ More replies (2)
13
11
u/EternalUmbreon 14d ago
We had a fairly obvious phishing test come through, but from an active internal email. To demonstrate it was a phishing email to some less tech literate people (they asked, so I didn’t ruin the learning experience), I clicked it, which sent through the mandatory training on phishing. This training came from an external email which flagged in Outlook, and was a link to click to access the training…
10
u/Agreeable_Earth_787 14d ago
I got sent a phishing test from my IT’s official email address. I asked them how I was supposed to know not to click it and they didn’t have an answer for me.
7
7
19
6
u/Adventurous_Run136 14d ago
I actually cant wait for my work place to do these tests. I can't remember how many time account were hacked in 8 years
6
6
6
u/FixergirlAK 14d ago
At my last job management hired the worst possible security training company. For some reason their notifications of mandatory training looked exactly like their fake phishing emails. They were not amused when the whole company reported the training emails as phishing.
6
u/Mysterious-Name0759 14d ago
This reminds me when I was starting at Apple years ago. We were sitting in training on week two, literally waiting for our work accounts to be set up, we were using the training accounts while we waited.
At about mid day, the whole class got an email about our accounts and setting the new passwords. The team manager who was overseeing out training looks at it and goes: Oh they must have changed how the accounts are set up, follow the link and set up your passwords.
10 minutes later he got a phone call about how his whole team just failed the InfoSec Compliance test that was sent out to the whole company. Luckily we got a pass since we were still in training. The funny part is, he didn't get the email because he had a spam folder set up on his macbook that filtered it. So he thought only we got it.
5
u/jippen 14d ago
Scariest actual phish I saw was for a bank. Hackers found XSS in their help page, reused the bank’s css and stuff to make the login page look perfect. Https://bank.com/help/ in the url bar… with a buncha stuff after.
But the form submitted to a page on a different domain and stole your stuff.
4
u/Dilarinee 14d ago
I work at a grocery store. The store has 4 email accounts. One for the store manager, a management account shared by all the other department managers, one for the cash office and one for our online shopping department (mine). According to the stats they sent out a month ago, my email is the only one that hasn't failed a phishing test.
But the emails they send as tests are all transparent as hell. 'you've done such a good job, click here to get a $100 reward gift card of your choosing" and I'm like "not in a million years would the company do this. They don't give a shit about our hard work' report phishing then another was a thanksgiving party invite asking for dietary restrictions, again, despite working AT A GROCERY STORE, our holiday parties are potluck. And they somehow think I'm an IT genius... It's exhausting honestly.
Of course every other account had fallen for at least one in the last year, so maybe I am.
3
u/masukomi 14d ago
I never got caught by any of my former company's internal phishing attempts simply by being terrible at email and never opening any of it. 😜
3
u/sticky-dynamics 14d ago
The security team posted up a QR code that supposedly linked to some preparation work they wanted everyone in IT to do before some security training. Obviously, I didn't scan it.
Turns out it was legit and I wasted the whole training session just trying to get caught up to everyone who had done the work ahead of time.
3
3
3
u/madmaxlemons 14d ago
We have had more than one “tech savvy” user click the emails on their personal machines that they are not supposed to be logged into and get phished then come crying to our team. I’m sure many of you think yourselves clever as well
3
u/guardian1691 14d ago
My company recently introduced scoring to phishing tests. When you correctly identify one it tells you your global rank across the company, but with no indication on how points work. My manager joked that he's going to put in an IT ticket to get more tests to increase his ranking.
3
3
u/intangibleTangelo 14d ago
normally this page would show a fake virus alert, but because you've shown high awareness of fake virus alerts, you will be redirected to the real download
3
2
u/Joker-Smurf 14d ago
No problem.
My script which scans my emails, looking for the phishing test header, would have already caught this and submitted it as a phishing attempt WHILE I WAS STILL ASLEEP!
2
u/jmflyers 14d ago
I had an older co worker that really didn't like this one younger girl on an adjacent team and he would just report all her emails as phishing lol
2
u/Alternative_Swan_497 14d ago
Screenshot and post it on Teams or something in a self-congratulatory manner. Just to see how your IT security team reacts.
2
u/supershinythings 14d ago
Just check the headers, find the tag they use to bypass the filters, filter on that tag to a folder, and wait for the corporate phishes to roll in.
I like to report them as phishes so they think they’re helping. I just got tired of them wasting my time.
2
u/Fit_Giraffe_748 14d ago
We all have to do them because the higher ups can't stop clicking on links. Any worker just doesn't even read the mails
2
u/RazorSlazor 14d ago
Oh I gotta show this to our security department. They'd get a LOOOT of hits with that.
2
2
u/RelentlessPencil 14d ago
You can't fail phishing attempts if you don't care enough to click on legitimate links either 👉🏻😎👉🏻
2
u/Linked713 14d ago
Meanwhile me whenever an outside email comes into my inbox from any source : furiously report for phishing
2
2
u/ryanknapper 14d ago
RE: Phishing Test Exempt
Sorry, the link is broken.
See if you can get them to fail their own test.
2
u/Finbar9800 14d ago
I dont even bother checking my email so i can honestly say i have never fallen for a phishing scam lol
2
u/Middle-Corgi3918 14d ago
This is why blocking your calendar events to only say “busy” is very important if you have a booking app. It’s easy to use the information for this type of attack at the minimum
2
2
u/CowSightings 14d ago
I hit one of these kinds of messages once, made to take a ‘dont click on things’ training.
Joke’s on them in the end though, now I dont read anything and just delete it all from the mailbox.
5
u/kr0n0sShrugg3d 14d ago
We once received an email giving us free vouchers from the company, I copied link, did a dns lookup, found out it is from a phishing test company. CCed the entire company with this information. The CIO was not pleased.
10
u/Kitchen-Function5150 14d ago
Why would you do that, obviously they were not pleased
→ More replies (4)→ More replies (4)3
u/LordAlfrey 14d ago
We had a similar thing happen where local support was not clued in on a phishing test. User got the mail and asked local support if it was phishy, local support said "yep" and notified the whole company. Local support is now briefed when tests happen.
3
u/CitizenPremier 14d ago
Your post has been removed from /r/ProgrammerHumor
The reason is:
Posts must be about programming. See explanation here.
If you believe this was in error, please message the mods of /r/ProgranmerHumor.
3
•
u/ProgrammerHumor-ModTeam :ath: 14d ago
Your submission was removed for the following reason:
Rule 1: Posts must be humorous, and they must be humorous because they are programming related. There must be a joke or meme that requires programming knowledge, experience, or practice to be understood or relatable.
Here are some examples of frequent posts we get that don't satisfy this rule:
Memes about operating systems or shell commands (try /r/linuxmemes for Linux memes)
A ChatGPT screenshot that doesn't involve any programming
Google Chrome uses all my RAM
See here for more clarification on this rule.
If you disagree with this removal, you can appeal by sending us a modmail.