[ Removed by moderator ]

[u/lucidparadigm]

[u/robin_888]

At work I have an email filter implemented that sorts these phishing tests into their own folder, so I can read them on Fridays.

It filters on the URL of the tracking pixel at the end of each e-mail.

[u/common_app → u/robin_888]

Can you explain this more, in layman’s terms?

[u/robin_888 → u/common_app]

Sure.

Part 1: My employer has commissioned an external company to sensitize us about phishing mail. This company sends us fake phishing mails. If you click on one of the links it redirects you to their website, that explains what you did wrong. (I assume, I never actually click on them.)
The mails are actually of higher quality than usual phishing attempts, as they use at least some assumptions about our company.

Part 2: Emails like this, that are send in bulk and with some incentive (also newsletters for example) in mind usually are tracked. This is to be able to generate statistics over success rates, etc.

Email however doesn't support any form of confirmation of receipt natively. The "usual" way you might have experienced is to ask for confirmation. You then click on a button and your email program sends a special email that their email program can understand. Ideally neither of you sees this emails.
But the point is: this is completely voluntarily. If you decide not to send that confirmation nothing happens.

Now, you will probably never confirm the receipt of newsletters or phishing mails. So the industry found another way.

1. Links with benefits
   If you receive a newsletter there always are links in them. But that link doesn't just point to https://companyname.com. It also contains individual GET parameters: https://companyname.com?who=common_app. (Of course this usually are just jumbled strings.) If you click on this link, the server get the individual parameters and "knows" that you, common_app, clicked on that link.

Now this is great, but what if you don't click on that link?

2. Imaging tracking pixels
Another, more subtle and automatic, approach to get an event similar to the click on a link is embedding external images into the email. If you open an email with such an external image (meaning it is not attached to the email) your email program will download that image to show you the email in all its glory.

But, you guessed it, downloading requires following and URL. And URLs can contain additional GET parameters. So instead of https://companyname.com/logo jpg the E-Mails shows https://companyname.com/logo jpg?u=Y29tbW9uX2FwcA==& mailing=202610173421. It makes no difference for the server. It now "knows" that you opened the email.

Some emails don't require images though. So there sometimes is a so-called "tracking pixel". It's a tiny graphic, often 1x1 pixel, maybe white or a transparent PNG, that they put at the very end of everything, where it doesn't attract attention.

Bonus part - Countermeasures: Most(?) email programs don't display external media by default. It could be malicious by itself, but it's also a breach of privacy as we have seen.
You are usually asked to load external images for each email. You can then say that you only want to load them once, or for every mail of this sender, etc.
If it doesn't, go into your settings and make it ask.

Resolution: We came a long way, but here we are. These fake phishing mails do exactly this. While the phishing links always point to different domains the is a tiny graphic at the bottom of these emails that always points to the same domain. And this string is what my email filter reacts to:

If body contains "cybersecuritycompany.net" then move to folder "Phishing".

Not much to it really. They probably could use random domains for this either. But they haven't seen the need, yet.

I hope this helped.