5 ms·
I once worked at a place that secretly red teamed it's employees with phishing emails. I diligently reported them all in public channels, unaware I was being du
by ipnon 5y ago
I once worked at a place that secretly red teamed it's employees with phishing emails. I diligently reported them all in public channels, unaware I was being duped, and received no response or promise to block the domains. Eventually I was fed up by the inaction, and inspected the payload in an isolated VM with execution disabled. I thought I was doing them a favor, but just the act of clicking on the link subjugated me to 3 days of mandatory fishing training. The saltiness left over from that incident could pickle an entire nation's agricultural output.
- briandoesdev 5y agoI ran internal phishing email exercises were I use to work. We never let users know when it was an exercise vs real-world event, they always got the same automated response that it was being looked into and that was all. I guess luckily for our users no one ever received any training or punishment for "falling" for our emails. We use to do it mainly for click rate tracking.
- not2b 5y agoMy company does phishing email exercises, and they've added a "report phishing" button to Outlook you're supposed to hit, either for the fake messages or any real phish attempts you get, or worse, fall for. The difficulty is that the company has outsourced many functions, meaning that there are external companies I often haven't heard of sending messages we have to interact with. Worse, one of those vendors has a very spammy-looking style and has even mis-spelled our company's name before in their mails.
- hansvm 5y agoI had one of these! If you reported the email the threat analyzer would crawl the link and mark your account as having been phished. My eventual solution was to just set up a rule to forward them to IT (the links were always <phishing-provider-landing>/<my-guid>) and ask them to stop insulting us.