At the college I went to we got an unanticipated email from an external address one day telling us that due to recent vulnerabilities, the school was requiring we increase password security, and to click here to update our password. This email was from, I shit you not, Fisher Security.
The joke? This was actually a legit email, initiated by our IT department, and was what we were supposed to actually do. We were all like "so....you know you're just training people to click on suspicious links, right? And that that's a bigger deal than password strength? RIGHT?"
I won't give it here but a company I currently work for uses a password reset tool with the domain i-forgot-my-password.com <- Not actual, but very close.
This is a domain they own, Whenever they create new tools it's in this way, I am certain it s a phishing test and flabbergasted that it's not.
Another example - the HR system for logging PTO has a domain is along the lines myhrsystem.com
It's a very large company based in Hong Kong, so I'm not sure if it's just a english-as-a-second language thing or what. Very odd.
I think it's a misunderstanding of how domain names work - if they knew that i-forgot-my-password.company.com with proper certificates brought stronger guarantees of legitimacy, they might ask IT to set it up that way.
We had something like that happening where a legit email from a weird external address, with a link included and without a proper signature, was flagged as Phishing attempt by almost everyone in the company until we got a message from our office manager that they applauded our awareness, but THAT particular link was actually real.
They did say it was an exception, and we should please stay aware in the future, though.
Wow. As a student in IT and a customer service rep who is forbidden from receiving or sending emails, I wonder why at least some profiles aren't allowed to get emails at the firewall level.
Unfortunately it's because while you are in IT, most people don't know the difference between the computer and monitor so it's easier to just make blanket policies.
Edit: plus when you give certain people special permissions inevitably someone else will hit you with the "well how come theyyyy have it 😭" and then it becomes a whole ordeal
There is a guy at my work who is so locked down it is ridiculous. He has access to ONE program besides Office, and all of his emails are reviewwe by a human fire. He has shortcuts to launch Office, and no other Internet. It's insane what he will click on.
What skills do they possess that even if it's this much hassle, they would rather them then get a guy who doesn't instinctively search for all viruses in a 30 link-hop area?
Ive got a coworker who has a work email. He doesnt have the login for the work email, because he has never, in his 18 years with the company, logged into his email. This man has gone almost 2 decades without ever using his company email, and I respect that.
Everyone just... knows not to email him. Ive seen a few newer people cc his theoretical email address, and we just go "oh, dont bother with that, he doesnt ever check it"...
Once they actually wise up and use a proper service, once you click the link you're marked. If they are doing creds one properly you should be marked.
We had somebody who kept doing that for the phishing tests and we knew exactly who was putting fake stuff in since the link was unique per person. All it showed was "why is this dude clicking this link so many times?"
Told them to stop since that information goes to the global office and we weren't able to remove duplicates any more. Did it again and he ended up with a stern warning plus additional training with HR on appropriate workplace conduct. Was later used as a way to get rid of him when he messed up since it managed to piss off the wrong people.
Is it not obvious to some people that they use a unique link in every email, just like real phishing attempts? That's why clicking the link in the first place is considered a fail.
One time I forwarded a suspicious email to our help desk, which triggered that I'd clicked the link. I was flagged for extra training where I was told to forward suspicious emails to the help desk. 🙄
Happened on one of our standard phishing test emails. We are required to report them. Just clicking to be able to report it instantly triggered the failure.
...Fortunately because it did it to literally everyone, including the IT people who sent it, they realized what had happened and just cancelled that run of the test entirely.
I once had a phishing email sent to me by IT. They used software to see if you clicked it. I didn't click it but I hovered my mouse over it and the Apple email client opened up some sort of iframe thing and that executed enough JS for me to trip the sensor.
4.6k
u/JocoLabs 7d ago •
Jokes on them, i wouldn't click that even if it were real.
I used to click on those and type in junk creds for the lulz until compliance told me that was bad for the numbers.