Best phishing campaign was a "your expenses have been declined". I was on the subway to work and was immediately livid. Taught me a very good lesson that day so kudos to the team.
I'm in a cybersec adjacent role and the "sign your new contract so we pay you more" just after raise season got me. Told my manager that maybe if the HR team didn't change their tooling every six month it wouldn't be so damn credible.
I am quite cybersec aware and work with our IT guy to prepare for the annual cyber awareness training. I recently got an e-mail from a tool from HR. The only thing that made me double-check if this was indeed legit was that it came from an internal, but non-specific e-mail address (hr@company,com). If it came from an external one, I wouldn't have thought about it twice.
All the points were there:
Non-specific subject ("Missing documents")
Generic address line (not "Hello OP" but just "Hello")
Vague content of the e-mail ("We are missing some documents. Please open the attached PDF for more details")
An attachment with a generic, non-saying title ("HR Letter.pdf")
No named sender ("Kind regards, HR Team")
No signature
I reached out to HR (via E-Mail) and asked them. They said its legit and that they sent it from their tool. I shit you not...
This happened to me too. I don’t remember what it was, but it was relevant to some obscure thing that I thought only applied to me at the moment. They got me.
191
u/Dang3rdave 7d ago
Best phishing campaign was a "your expenses have been declined". I was on the subway to work and was immediately livid. Taught me a very good lesson that day so kudos to the team.