5 ms·

All of this reminds me of a hilarious situation at a previous employer. As is standard corporate practice, they used to tell people to inspect links by hovering

All of this reminds me of a hilarious situation at a previous employer. As is standard corporate practice, they used to tell people to inspect links by hovering over them to confirm that they lead to the official website of the sender. People kept falling for phishing links though, so they got a Trend Micro device to scan emails, which also rewrote every link in it to point to their URL scanning service, which means every link now looks like https://ca-1234.check.trendmicro.com/?url= https://ca-1234.check.trendmicro.com/?url=...; I guess no one would be allowed to click on any link in an email at that company. Of course, their URL rewrites also broke a good number of links, so you'd wake up to a production incident, and then have to get your laptop, log in manually to Pagerduty/Sentry or what have you, and look up the incident details from the email...

thinkingtoilet 1y ago
I had the opposite funny experience. When I worked for Global MegaCorp, they would occasionally send out phishing emails and if you clicked on a link it would be recorded and you would have to do trainings if you got fooled a couple times. Eventually everyone learned to stop clicking on links on emails. That's good. However, they sent out a yearly survey to get feedback from all the employees and no one clicked the link so they had to send out follow up emails saying the original emails are legit and it's ok to click the links in them.
- illusive4080 1y ago
  I’m designing a new phishing campaign that sends a pre-email telling the user they’re getting a legitimate email with <subject> then sending the phishing test email with that subject. My company does this too by the way. Usually for external things like surveys they send a pre-email.
- shawn_w 1y ago
  >... they had to send out follow up emails saying the original emails are legit and it's ok to click the links in them. Sounds like something a phisher would do. Better not click.
  - fiddlerwoaroof 1y ago
    I worked somewhere that would send the notice to do mandatory security training from a suspicious email and the message was very short (something like you have been enrolled in training at https://phishing.site.example.com/abdlejrj https://phishing.site.example.com/abdlejrj). In always just reported them as phishing and no one ever followed up.
    - mcny 1y ago
      Every time I reported an email as a suspected phishing attempt at an ISP I worked for, I got an automated reply congratulating me for recognizing the test email. I don't think I ever got a real phishing email at that company. But then I never had to email anyone outside the company.
- supriyo-biswas 1y ago
  The way they used to handle that at a FAANG I worked for was they had this app installed on each machine issued by IT, that would ask you a question daily about some aspect of your workplace. Handles all the phishing concerns, except that participation was either low or the feedback was negative, which would lead to the leaders issuing subtle threats to the team about how they'd find out the involved folks and fire them. If you tried to uninstall it, it'd be back in a few hours through policy management software (jamf and its ilk). On the internal discussion forums, they'd nuke threads talking about how to disable that software. So, in the end, people just started giving the best possible feedback regardless of the team or manager performance. I never really needed those threads, all I needed was tcpdump and then blocking its domain in the hosts file :)
  - estimator7292 1y ago
    That sounds absolutely horrifying
    - bsjaux628 1y ago
      The behavior is Org and department specific. What happens is that those questions are map to a 'Org Health' metric (satisfaction, innovation, etc) and they are Manager aggregated, so your Manager's manager saw those report and your Director saw your skip manager's and so on. I would say my org was very healthy in terms of handling it, no treaths or anything, just asking us what we thought was going wrong, how to improve and coming up every year with a new SOP to do the connection's review. Again, YMMV.
  - gusgus01 1y ago
    Somehow this and the parent both represent Amazon. Daily questions and a yearly survey that security had to assure us was legit.
  - eru 1y ago
    > So, in the end, people just started giving the best possible feedback regardless of the team or manager performance. That seems to be the best possible strategy for any feedback you have to give as a captive audience? Reminds me of the feedback German companies are forced to give about their employees. It's like a formal letter of reference, but you can and will be sued if you you anything negative. Consequences are as you would expect. And because there has been an inflation in how complimentary these letters are, people started suing when their letter wasn't flowery enough, because that somehow could be read as an implicit criticism. (Just like how A is a bad mark, when everyone else gets A+.)
- red369 1y ago
  In New Zealand, there is a long list of companies who need to reach out to a large number of current and former employees, and try to convince them to go to a website and enter sensitive information to receive some money (1). Where I'm working, we found it hard, even for current employees, to convince them that it's not either phishing, or a phishing test. This is getting off-topic, but I found it interesting so I'll include more details anyway. In a lot of cases, all the fuss is to return amounts that are tiny, and yet the companies need to keep reaching out and trying to convince people. I got $0.06 (2) from my current employer. Because I've moved countries with them, I ended up falling in the category of needing to provide some bank/tax details. Of course, I wanted to log in with the silliest OS I could think of to test/mess with the tracking dashboard, and so somehow I managed to enter my DOB wrong, which even further increased the back-and-forward and emails involved (I was in the project, so the Payroll peeps involved probably didn't hold it against me). The re-calculation which led to the payment actually worked out that I had been underpaid in come calculations, but overpaid by far more (although still very, very little) in others. The company believed they couldn't offset, so all the fuss was for a tiny amount, which I felt I really wasn't owed anyway. Also unfortunate, was that if any former employee didn't bother to claim the amount because it's so small it's not worth the fuss, it just leads to more work in follow-ups. New Zealand Holidays Act is quite an interesting area in general, in a how-can-it-possibly-be-this-hard kind of way. I think it contributes to the reputation of NZ payroll being one of the trickiest in the world. 1) https://thespinoff.co.nz/business/27-06-2019/cheat-sheet-what-went-wrong-with-our-holiday-pay https://thespinoff.co.nz/business/27-06-2019/cheat-sheet-wha...
  - JaggedNZ 1y ago
    Or IRD (NZ tax dept.) a few years back sending out a survey on a .co.nz domain. Gave their security team a hard time for that one!
    - Nition 1y ago
      IRD's phone calling campaign about enabling two-factor auth was also not great.
  - eru 1y ago
- bryanrasmussen 1y ago
  noted for my phishing business: track first phishing attempt, send follow up email two days later saying the first one was legit.
  - thinkingtoilet 1y ago
    Note, this only worked because the follow up email came from the head of the division.
- noduerme 1y ago
  This is hilarious. I wish I'd thought or doing it to my 85 year old father. Maybe I could have saved him the last 10 years of following spam email links into hellish conspiracy holes and identity scams. It didn't matter how many times I told him never to click on an email. There should be a white hat phishing service you can hire to target your elders. Then when they give up their social security number, someone shows up at their door with a big cake with all their personal details in frosting.
- ozim 1y ago
  That's actually super funny and it is not first time I see quite the same story. They train people not to click links and then someone in management is fucking stupid enough to pull "just send an email with a link" kind of crap instead of properly planning the communication in advance by telling people that there will be a survey, what will be the company that is sending it, when they should expect it - but that just "too much work". I would fire that kind of clown ass on the spot for not doing their job.
- janc_ 1y ago
  Doesn't help that most surveys are on external unknown domains, and look very suspicious (tracking codes, etc.). I get such links to surveys & other commercial bullshit from my bank too, like they want to train you to click fishing links…
- maccard 1y ago
  I had a similar experience. I got pulled up for not completing my anti phishing training. It had been sent from a third party contractor with a random domain, but apparently I was supposed to know that was safe but the other external links were bad.
JustExAWS 1y ago
I got this email from AWS regarding my personal account. Greetings from AWS, There are upcoming changes in how you will be receiving your AWS Invoices starting 9/18/2025. As of 9/18/2025, you will receive all AWS invoices from “no-reply@tax-and-invoicing.us-east-1.amazonaws.com”. If you have automated rules configured to process invoice emails, please update the email address to “no-reply@tax-and-invoicing.us-east-1.amazonaws.com”. This was brain dead. If I saw an email with that sender, I would think it was a scam. They had to walk it back. For context, I get random other emails about things like Lambda runtime deprecation from “no-reply-aws@amazon.com” which looks a lot more official. And “aws-marketing-email-replies@amazon.com”
- noduerme 1y ago
  Funny, I got an email today from them saying that so many people had protested against this change, they were going to pause it for review. I don't think I've ever seen them respond to criticism like that before.
  - JustExAWS 1y ago
    Yep Greetings from AWS, We recently notified you about upcoming changes to AWS invoice emails (subject “Important – AWS Invoice e-mail address changes”). Based on customer feedback, we are reviewing this change to determine a better customer experience. The email you receive your AWS invoices from will not change on 09/18/2025, as originally communicated, and you will continue to receive all AWS invoices from the usual email address. Sincerely, The Amazon Web Services Team
kimixa 1y ago
The company I used to work for had the same thing - everything was a rewritten URL (this was a Microsoft shop so it was rewritten to something like "safe.protected.outlook.com/?random_spew". From what I remember, yo)u couldn't even see the original URL in that (or it might have just been long enough random arguments to be completely impossible to find). Nothing raises my suspicions quite like something calling itself "safe".
- blauditore 1y ago
  > Nothing raises my suspicions quite like something calling itself "safe". Ah yes, it's like a country having "democratic republic" in it's name - if you have to say it, it's probably not true.
  - cyanydeez 1y ago
    Or any US law that says "PROTECT" or "FREEEDOM"
    - mlry 1y ago
      Oh, come on. Freedom of Information Act sounds kinda nice!
      - 0x3444ac53 1y ago
        There's exceptions to every rule
        cyanydeez 1y ago
        FOIAs are still faith based anyway. And we know faith based systems arn't going to survive.
OscarCunningham 1y ago
I had the opposite problem at my last company. When you hover over a link Apple's Mail app opens a preview of the page. So if you try to see the URL then you automatically visit the link and get sent for more training.
- javcasas 1y ago
  I learnt that all those emails were sent through some relay. I blacklisted the relay. And then, some real training email notifications were sent through the same relay. But that relay is used for phising, so I just refuse to open the training email. Win-win.
- prmoustache 1y ago
  Isn't that behavior desactivable?

thinkingtoilet 1y ago

I had the opposite funny experience. When I worked for Global MegaCorp, they would occasionally send out phishing emails and if you clicked on a link it would be recorded and you would have to do trainings if you got fooled a couple times. Eventually everyone learned to stop clicking on links on emails. That's good. However, they sent out a yearly survey to get feedback from all the employees and no one clicked the link so they had to send out follow up emails saying the original emails are legit and it's ok to click the links in them.

illusive4080 1y ago
I’m designing a new phishing campaign that sends a pre-email telling the user they’re getting a legitimate email with <subject> then sending the phishing test email with that subject. My company does this too by the way. Usually for external things like surveys they send a pre-email.
shawn_w 1y ago
>... they had to send out follow up emails saying the original emails are legit and it's ok to click the links in them. Sounds like something a phisher would do. Better not click.
- fiddlerwoaroof 1y ago
  I worked somewhere that would send the notice to do mandatory security training from a suspicious email and the message was very short (something like you have been enrolled in training at https://phishing.site.example.com/abdlejrj https://phishing.site.example.com/abdlejrj). In always just reported them as phishing and no one ever followed up.
  - mcny 1y ago
    Every time I reported an email as a suspected phishing attempt at an ISP I worked for, I got an automated reply congratulating me for recognizing the test email. I don't think I ever got a real phishing email at that company. But then I never had to email anyone outside the company.
supriyo-biswas 1y ago
The way they used to handle that at a FAANG I worked for was they had this app installed on each machine issued by IT, that would ask you a question daily about some aspect of your workplace. Handles all the phishing concerns, except that participation was either low or the feedback was negative, which would lead to the leaders issuing subtle threats to the team about how they'd find out the involved folks and fire them. If you tried to uninstall it, it'd be back in a few hours through policy management software (jamf and its ilk). On the internal discussion forums, they'd nuke threads talking about how to disable that software. So, in the end, people just started giving the best possible feedback regardless of the team or manager performance. I never really needed those threads, all I needed was tcpdump and then blocking its domain in the hosts file :)
- estimator7292 1y ago
  That sounds absolutely horrifying
  - bsjaux628 1y ago
    The behavior is Org and department specific. What happens is that those questions are map to a 'Org Health' metric (satisfaction, innovation, etc) and they are Manager aggregated, so your Manager's manager saw those report and your Director saw your skip manager's and so on. I would say my org was very healthy in terms of handling it, no treaths or anything, just asking us what we thought was going wrong, how to improve and coming up every year with a new SOP to do the connection's review. Again, YMMV.
- gusgus01 1y ago
  Somehow this and the parent both represent Amazon. Daily questions and a yearly survey that security had to assure us was legit.
- eru 1y ago
  > So, in the end, people just started giving the best possible feedback regardless of the team or manager performance. That seems to be the best possible strategy for any feedback you have to give as a captive audience? Reminds me of the feedback German companies are forced to give about their employees. It's like a formal letter of reference, but you can and will be sued if you you anything negative. Consequences are as you would expect. And because there has been an inflation in how complimentary these letters are, people started suing when their letter wasn't flowery enough, because that somehow could be read as an implicit criticism. (Just like how A is a bad mark, when everyone else gets A+.)
red369 1y ago
In New Zealand, there is a long list of companies who need to reach out to a large number of current and former employees, and try to convince them to go to a website and enter sensitive information to receive some money (1). Where I'm working, we found it hard, even for current employees, to convince them that it's not either phishing, or a phishing test. This is getting off-topic, but I found it interesting so I'll include more details anyway. In a lot of cases, all the fuss is to return amounts that are tiny, and yet the companies need to keep reaching out and trying to convince people. I got $0.06 (2) from my current employer. Because I've moved countries with them, I ended up falling in the category of needing to provide some bank/tax details. Of course, I wanted to log in with the silliest OS I could think of to test/mess with the tracking dashboard, and so somehow I managed to enter my DOB wrong, which even further increased the back-and-forward and emails involved (I was in the project, so the Payroll peeps involved probably didn't hold it against me). The re-calculation which led to the payment actually worked out that I had been underpaid in come calculations, but overpaid by far more (although still very, very little) in others. The company believed they couldn't offset, so all the fuss was for a tiny amount, which I felt I really wasn't owed anyway. Also unfortunate, was that if any former employee didn't bother to claim the amount because it's so small it's not worth the fuss, it just leads to more work in follow-ups. New Zealand Holidays Act is quite an interesting area in general, in a how-can-it-possibly-be-this-hard kind of way. I think it contributes to the reputation of NZ payroll being one of the trickiest in the world. 1) https://thespinoff.co.nz/business/27-06-2019/cheat-sheet-what-went-wrong-with-our-holiday-pay https://thespinoff.co.nz/business/27-06-2019/cheat-sheet-wha...
- JaggedNZ 1y ago
  Or IRD (NZ tax dept.) a few years back sending out a survey on a .co.nz domain. Gave their security team a hard time for that one!
  - Nition 1y ago
    IRD's phone calling campaign about enabling two-factor auth was also not great.
- eru 1y ago
bryanrasmussen 1y ago
noted for my phishing business: track first phishing attempt, send follow up email two days later saying the first one was legit.
- thinkingtoilet 1y ago
  Note, this only worked because the follow up email came from the head of the division.
noduerme 1y ago
This is hilarious. I wish I'd thought or doing it to my 85 year old father. Maybe I could have saved him the last 10 years of following spam email links into hellish conspiracy holes and identity scams. It didn't matter how many times I told him never to click on an email. There should be a white hat phishing service you can hire to target your elders. Then when they give up their social security number, someone shows up at their door with a big cake with all their personal details in frosting.
ozim 1y ago
That's actually super funny and it is not first time I see quite the same story. They train people not to click links and then someone in management is fucking stupid enough to pull "just send an email with a link" kind of crap instead of properly planning the communication in advance by telling people that there will be a survey, what will be the company that is sending it, when they should expect it - but that just "too much work". I would fire that kind of clown ass on the spot for not doing their job.
janc_ 1y ago
Doesn't help that most surveys are on external unknown domains, and look very suspicious (tracking codes, etc.). I get such links to surveys & other commercial bullshit from my bank too, like they want to train you to click fishing links…
maccard 1y ago
I had a similar experience. I got pulled up for not completing my anti phishing training. It had been sent from a third party contractor with a random domain, but apparently I was supposed to know that was safe but the other external links were bad.

JustExAWS 1y ago

I got this email from AWS regarding my personal account. Greetings from AWS, There are upcoming changes in how you will be receiving your AWS Invoices starting 9/18/2025. As of 9/18/2025, you will receive all AWS invoices from “no-reply@tax-and-invoicing.us-east-1.amazonaws.com”. If you have automated rules configured to process invoice emails, please update the email address to “no-reply@tax-and-invoicing.us-east-1.amazonaws.com”. This was brain dead. If I saw an email with that sender, I would think it was a scam. They had to walk it back. For context, I get random other emails about things like Lambda runtime deprecation from “no-reply-aws@amazon.com” which looks a lot more official. And “aws-marketing-email-replies@amazon.com”

noduerme 1y ago
Funny, I got an email today from them saying that so many people had protested against this change, they were going to pause it for review. I don't think I've ever seen them respond to criticism like that before.
- JustExAWS 1y ago
  Yep Greetings from AWS, We recently notified you about upcoming changes to AWS invoice emails (subject “Important – AWS Invoice e-mail address changes”). Based on customer feedback, we are reviewing this change to determine a better customer experience. The email you receive your AWS invoices from will not change on 09/18/2025, as originally communicated, and you will continue to receive all AWS invoices from the usual email address. Sincerely, The Amazon Web Services Team

kimixa 1y ago

The company I used to work for had the same thing - everything was a rewritten URL (this was a Microsoft shop so it was rewritten to something like "safe.protected.outlook.com/?random_spew". From what I remember, yo)u couldn't even see the original URL in that (or it might have just been long enough random arguments to be completely impossible to find). Nothing raises my suspicions quite like something calling itself "safe".

blauditore 1y ago
> Nothing raises my suspicions quite like something calling itself "safe". Ah yes, it's like a country having "democratic republic" in it's name - if you have to say it, it's probably not true.
- cyanydeez 1y ago
  Or any US law that says "PROTECT" or "FREEEDOM"
  - mlry 1y ago
    Oh, come on. Freedom of Information Act sounds kinda nice!
    - 0x3444ac53 1y ago
      There's exceptions to every rule
      - cyanydeez 1y ago
        FOIAs are still faith based anyway. And we know faith based systems arn't going to survive.

OscarCunningham 1y ago

I had the opposite problem at my last company. When you hover over a link Apple's Mail app opens a preview of the page. So if you try to see the URL then you automatically visit the link and get sent for more training.

javcasas 1y ago
I learnt that all those emails were sent through some relay. I blacklisted the relay. And then, some real training email notifications were sent through the same relay. But that relay is used for phising, so I just refuse to open the training email. Win-win.
prmoustache 1y ago
Isn't that behavior desactivable?