5 ms·
Did you click on the "Report Phishing attempt" button installed by your IT center in your mail client? Sorry for the probable sarcasm. In a company that size,
by Rygian 3y ago
Did you click on the "Report Phishing attempt" button installed by your IT center in your mail client?
Sorry for the probable sarcasm. In a company that size, if the IT center does not provide a means to report phishing attempts then there are more serious problems than a dodgy email campaign.
- sebtron 3y agoI wanted to, but I could not find it. It turn out I could not see the "report phishing" button because of an Outlook glitch. Thanks Microsoft.
- lrem 3y agoForward the email to your security org?
- alistairSH 3y agoThis. We have a dedicated phish/scam/it-sec channel in Slack for this (in addition to an embedded “report this email” plug-in in Outlook).
- sebtron 3y agoI did end up forwarding the email to another IT service address (one that I knew was legit). They thanked me for the feedback and said they would improve the message.
- TeMPOraL 3y agoFWIW, I did exactly that a few times where I was 90% certain the e-mail is legit, but it still looked like a phishing attempt. The IT department needs to learn to do better, this is inexcusable, especially in a corporation with otherwise restrictive policies that waste ridiculous amounts of money and effort (think: Windows Defender real-time "protection" on developer machines, with no way to exclude your repos).
- natebc 3y agoThis is even worse in companies that have security offices actively sending out phishing emails worded as internal emails from your company that shame you if you click any of the links in them. email is well and truly dead.
- dunham 3y agoThat reminds me that we had a "chief architect" who sent out his fairwell email with a link to his linked-in page in the footer, but the link actually went to a certain music video on youtube. I suppose, if you want to train people to not click on links, that's a fun way to do it.
- ano-ther 3y agoIt’s a good idea. I am usually a bit pessimistic about it though. If their SOP doesn’t account for “looks like phishing but is from internal sender” then chances are that nobody connects the dots and informs that sender. The intelligence of a small and motivated IT team seems difficult to scale.