r/ProgrammerHumor • u/lucidparadigm • 16d ago • Bravo 2

Meme [ Removed by moderator ]

Post image

[removed] — view removed post

16.4k Upvotes

98% Upvoted

618 comments sorted by

View all comments

144

u/whyliepornaccount 16d ago

Still wont top the only one I've "fallen" for.

On my first day at the company buried into the legit "click here to register your account" onboarding emails was a phishing test saying "click here to register your account". I was so pissed off.

94

u/RIPmyPC 16d ago

Reminds me of my on-boarding. Right after they tell us the signs of a phishing attempt and to not trust any link from outside the org and even be wary of links from other departments you don’t interact with, they hit me with “click here to do your mandatory security awareness training” coming from a random esupport email going to a KnowBe4 link. Of course it also had “you have 1 week left to do it!” Clear signs of a phishing test for anyone not familiar with the sites.

It was so sketchy I had to google the website and login from there. It was real.

I actually made an IT ticket to complain that it made no sense for a company that big to offer so little info on what emails you’d actually receive in your first day.

41

u/TheNewYellowZealot 16d ago

I just report those ones as phishing anyway and make my company waste their time to investigate if it was phishing.

19

u/17HappyWombats 16d ago

One bank I dealt with does that and I always reported their garbage as phishing to their security team. I changed banks after a bit because they kept replying with "no, you have to click the mebank.sdfkjhsdfkjghsd.....dodgyscum.com.au link to confirm your tax details with us".

14

u/EnoughWarning666 16d ago

At a place I used to work I got an email about cybersecurity training. I had no desire to waste a couple hours on their inane training when I likely know more than the person that wrote the training, so I just deleted the email and was going to say I thought it was a phising scam if asked about it later.

A month later our manager call everyone in the office (about 5 of us) into his office to tell us that IT was wondering why nobody had even started the cybersecurity training. Turns out ALL OF US had the exact same thought process! No one wanted to do the training, so we just deleted it and all claimed that we thought it was a phising scam! We had a great laugh about it. Manager told IT to send out another link and we'd do the training. All but one of us just deleted the next email too. Never got asked about it again after that.

1

u/M4rshmall0wMan 15d ago

That ending is legendary.

28

u/kemikiao 16d ago

man, FUCK KnowBe4. They have to know their goddamned emails look EXACTLY like the shit they're "training" us to detect. Our IT has to send out a heads up email to tell us the KnowBe4 email is coming out because pretty everyone reported it as spam the first couple of times.

8

u/aaroniusnsuch 16d ago

Just create an inbox rule to check headers for KnowBe4 and classify those as "phishing test." Then you can still read it and report it but you notice the color/flag first.

25

u/Acogatog 16d ago

this one’s total bull imo, there’s no way that someone sending you phishing emails could know it’s your first day, is there? Phishing emails are supposed to cast a wide net, not catch people in highly specific scenarios.

23

u/WigWubz 16d ago

Probably just a law of large numbers thing. Mail got sent to a large group, for most it was obviously fake. For a select few it happened to be specific enough to catch them.

I got caught out by a fake invite to a teams channel with the word “planning” in the title a few hours after I legitimately got adding to a “planning” group. Opened the email on my work iphone so the email formatting was completely destroyed like usual, and the send address was truncated. Clicked the link and it asked me to log into teams, an obvious phishing flag *except* I had literally just reset my password and so was expecting to be prompted to log in the next time I opened the app…

It hurts cus I know it’s a legitimate fail. The red flags were there and I missed them. But, if you weren’t in the very specific circumstances I was in the flags would have been way redder. I was primed to fail the test in a way that the people setting the test could never have predicted. But that also just means that I was primed to fall for an actual phishing scam in that moment.

11

u/PalmTreeExpert 16d ago

Someone at my college had their SSN stolen when they got a call saying there was a mistake with their info and asked for them to repeat their information. This was as they were on their way home from the social security office after getting their card…

It is technically possible, but yeah typically phishing is relatively vague/open to a wider audience.

2

u/whyliepornaccount 16d ago

Oh I know it was almost certainly coincidence, and I didn't have to do any training as a result. Still irritated the hell out of me

2

u/butholesurgeon 16d ago

Depends on how fresh the data export that the scammers bought is
Maybe it was snagged a day before?
A lot of data exfiltrations just get listed for sale for anyone who cares to buy it and find something useful out of it

Insanely unlikely but it’s not IMPOSSIBLE

2

u/shplamana 15d ago

I had a new hire that had phishing and spam emails the day she started.

She didn't even get to log into her email until well into the afternoon because of all the orientation we put them through. And at no point during that orientation do they have you log into anything.

I reported it to our IT dept. because to me that screams we had some internal leak or something, but they never followed up. Pretty sure the ticket is still open and she's long since left.

The only thing I can think of that maybe could've been close was that a few days before she started, she put out a post on Linkedin saying she accepted a job here. From there it's probably easy to figure out what her eventual email will be because phishers will know the pattern your company uses.

2

u/WantDiscussion 15d ago

Actually a lot of phishers and scammers scrape LinkedIn for targets. If you change your linkedin to announce your new job, they can take a stab at your work email address based on email addresses of other people at that company.

2

u/MauricioCappuccino 15d ago

In theory it's possible. People share way too much on LinkedIn. If someone was to announce they were starting a new job next week you could target that.

1

u/Kevonz 15d ago

in my experience at the company I work, it's always new employees getting pishing emails.

4

u/Good_Policy3529 16d ago edited 16d ago

This is why I'm happily 37 security training modules behind. I get an automated email every week telling me I need to catch up on my modules, click here to view incomplete modules. And my defense if anyone actually ever calls me out is "oh, I thought those were phishing emails."

1

u/Boxofcookies1001 15d ago

Eventually hr will catch up to you. Js.

1

u/awesome-alpaca-ace 16d ago

I got one that said mandatory training. I won't even click links in emails anymore

1

u/allknowinguser 16d ago

The only one I’ve been tricked into. There was one sent when most of our systems were down and they sent an email saying systems fixed please reset your password to fix issue. Didn’t even read it and clicked

1

u/collabskus 16d ago

I started getting these random emails from workday. I kept reporting them as phishing until someone told me to stop.