3 ms·
At a place I worked at they did something similar with the most obviously fake email possible. Seemed like a pointless box ticking exercise. Funny enough IT s
by Jonnax 6y ago
At a place I worked at they did something similar with the most obviously fake email possible.
Seemed like a pointless box ticking exercise.
Funny enough IT sent out an email about a Windows update rolling out (upgrade to a new version like 1709) that looked ever dodgier than their fake email. That had people reporting that as phishing.
- jiofih 6y ago> Seemed like a pointless box ticking exercise. Phishing emails often look pretty obvious - that’s part of the program! It filters out people you can’t trick and leaves you only with the most gullible ones. Had the same at a previous company. If you use GMail, IT needs to manually approve the mail to avoid it going into the spam folder. A huge warning saying “this message has been excluded from your spam filter by your IT department” shows up at the top. People still click through...
- pinum 6y agoThat might actually make it seem like the email has been explicitly sanctioned by IT. "Huh, this email is a bit weird, but IT says it's okay." click
- zulln 6y ago> Phishing emails often look pretty obvious - that’s part of the program! It filters out people you can’t trick and leaves you only with the most gullible ones. For frauds that requires the attacker to spend time with the victim, sure. For a fully automated phishing attack? There is no reason to lose out on people early on. And for a targeted attack against a company? Makes even less sense to make it obvious.
- Rexxar 6y agoIt could be a strategy to make people less careful : send one or two "obvious" fake phishing email and then the real one a little later when they are confident they can avoid phishing.