5 ms·

I had the opposite funny experience. When I worked for Global MegaCorp, they would occasionally send out phishing emails and if you clicked on a link it would b

I had the opposite funny experience. When I worked for Global MegaCorp, they would occasionally send out phishing emails and if you clicked on a link it would be recorded and you would have to do trainings if you got fooled a couple times. Eventually everyone learned to stop clicking on links on emails. That's good. However, they sent out a yearly survey to get feedback from all the employees and no one clicked the link so they had to send out follow up emails saying the original emails are legit and it's ok to click the links in them.

illusive4080 1y ago
I’m designing a new phishing campaign that sends a pre-email telling the user they’re getting a legitimate email with <subject> then sending the phishing test email with that subject. My company does this too by the way. Usually for external things like surveys they send a pre-email.
shawn_w 1y ago
>... they had to send out follow up emails saying the original emails are legit and it's ok to click the links in them. Sounds like something a phisher would do. Better not click.
- fiddlerwoaroof 1y ago
  I worked somewhere that would send the notice to do mandatory security training from a suspicious email and the message was very short (something like you have been enrolled in training at https://phishing.site.example.com/abdlejrj https://phishing.site.example.com/abdlejrj). In always just reported them as phishing and no one ever followed up.
  - mcny 1y ago
    Every time I reported an email as a suspected phishing attempt at an ISP I worked for, I got an automated reply congratulating me for recognizing the test email. I don't think I ever got a real phishing email at that company. But then I never had to email anyone outside the company.
supriyo-biswas 1y ago
The way they used to handle that at a FAANG I worked for was they had this app installed on each machine issued by IT, that would ask you a question daily about some aspect of your workplace. Handles all the phishing concerns, except that participation was either low or the feedback was negative, which would lead to the leaders issuing subtle threats to the team about how they'd find out the involved folks and fire them. If you tried to uninstall it, it'd be back in a few hours through policy management software (jamf and its ilk). On the internal discussion forums, they'd nuke threads talking about how to disable that software. So, in the end, people just started giving the best possible feedback regardless of the team or manager performance. I never really needed those threads, all I needed was tcpdump and then blocking its domain in the hosts file :)
- estimator7292 1y ago
  That sounds absolutely horrifying
  - bsjaux628 1y ago
    The behavior is Org and department specific. What happens is that those questions are map to a 'Org Health' metric (satisfaction, innovation, etc) and they are Manager aggregated, so your Manager's manager saw those report and your Director saw your skip manager's and so on. I would say my org was very healthy in terms of handling it, no treaths or anything, just asking us what we thought was going wrong, how to improve and coming up every year with a new SOP to do the connection's review. Again, YMMV.
- gusgus01 1y ago
  Somehow this and the parent both represent Amazon. Daily questions and a yearly survey that security had to assure us was legit.
- eru 1y ago
  > So, in the end, people just started giving the best possible feedback regardless of the team or manager performance. That seems to be the best possible strategy for any feedback you have to give as a captive audience? Reminds me of the feedback German companies are forced to give about their employees. It's like a formal letter of reference, but you can and will be sued if you you anything negative. Consequences are as you would expect. And because there has been an inflation in how complimentary these letters are, people started suing when their letter wasn't flowery enough, because that somehow could be read as an implicit criticism. (Just like how A is a bad mark, when everyone else gets A+.)
red369 1y ago
In New Zealand, there is a long list of companies who need to reach out to a large number of current and former employees, and try to convince them to go to a website and enter sensitive information to receive some money (1). Where I'm working, we found it hard, even for current employees, to convince them that it's not either phishing, or a phishing test. This is getting off-topic, but I found it interesting so I'll include more details anyway. In a lot of cases, all the fuss is to return amounts that are tiny, and yet the companies need to keep reaching out and trying to convince people. I got $0.06 (2) from my current employer. Because I've moved countries with them, I ended up falling in the category of needing to provide some bank/tax details. Of course, I wanted to log in with the silliest OS I could think of to test/mess with the tracking dashboard, and so somehow I managed to enter my DOB wrong, which even further increased the back-and-forward and emails involved (I was in the project, so the Payroll peeps involved probably didn't hold it against me). The re-calculation which led to the payment actually worked out that I had been underpaid in come calculations, but overpaid by far more (although still very, very little) in others. The company believed they couldn't offset, so all the fuss was for a tiny amount, which I felt I really wasn't owed anyway. Also unfortunate, was that if any former employee didn't bother to claim the amount because it's so small it's not worth the fuss, it just leads to more work in follow-ups. New Zealand Holidays Act is quite an interesting area in general, in a how-can-it-possibly-be-this-hard kind of way. I think it contributes to the reputation of NZ payroll being one of the trickiest in the world. 1) https://thespinoff.co.nz/business/27-06-2019/cheat-sheet-what-went-wrong-with-our-holiday-pay https://thespinoff.co.nz/business/27-06-2019/cheat-sheet-wha...
- JaggedNZ 1y ago
  Or IRD (NZ tax dept.) a few years back sending out a survey on a .co.nz domain. Gave their security team a hard time for that one!
  - Nition 1y ago
    IRD's phone calling campaign about enabling two-factor auth was also not great.
- eru 1y ago
bryanrasmussen 1y ago
noted for my phishing business: track first phishing attempt, send follow up email two days later saying the first one was legit.
- thinkingtoilet 1y ago
  Note, this only worked because the follow up email came from the head of the division.
noduerme 1y ago
This is hilarious. I wish I'd thought or doing it to my 85 year old father. Maybe I could have saved him the last 10 years of following spam email links into hellish conspiracy holes and identity scams. It didn't matter how many times I told him never to click on an email. There should be a white hat phishing service you can hire to target your elders. Then when they give up their social security number, someone shows up at their door with a big cake with all their personal details in frosting.
ozim 1y ago
That's actually super funny and it is not first time I see quite the same story. They train people not to click links and then someone in management is fucking stupid enough to pull "just send an email with a link" kind of crap instead of properly planning the communication in advance by telling people that there will be a survey, what will be the company that is sending it, when they should expect it - but that just "too much work". I would fire that kind of clown ass on the spot for not doing their job.
janc_ 1y ago
Doesn't help that most surveys are on external unknown domains, and look very suspicious (tracking codes, etc.). I get such links to surveys & other commercial bullshit from my bank too, like they want to train you to click fishing links…
maccard 1y ago
I had a similar experience. I got pulled up for not completing my anti phishing training. It had been sent from a third party contractor with a random domain, but apparently I was supposed to know that was safe but the other external links were bad.

illusive4080 1y ago

I’m designing a new phishing campaign that sends a pre-email telling the user they’re getting a legitimate email with <subject> then sending the phishing test email with that subject. My company does this too by the way. Usually for external things like surveys they send a pre-email.

shawn_w 1y ago

>... they had to send out follow up emails saying the original emails are legit and it's ok to click the links in them. Sounds like something a phisher would do. Better not click.

fiddlerwoaroof 1y ago
I worked somewhere that would send the notice to do mandatory security training from a suspicious email and the message was very short (something like you have been enrolled in training at https://phishing.site.example.com/abdlejrj https://phishing.site.example.com/abdlejrj). In always just reported them as phishing and no one ever followed up.
- mcny 1y ago
  Every time I reported an email as a suspected phishing attempt at an ISP I worked for, I got an automated reply congratulating me for recognizing the test email. I don't think I ever got a real phishing email at that company. But then I never had to email anyone outside the company.

supriyo-biswas 1y ago

The way they used to handle that at a FAANG I worked for was they had this app installed on each machine issued by IT, that would ask you a question daily about some aspect of your workplace. Handles all the phishing concerns, except that participation was either low or the feedback was negative, which would lead to the leaders issuing subtle threats to the team about how they'd find out the involved folks and fire them. If you tried to uninstall it, it'd be back in a few hours through policy management software (jamf and its ilk). On the internal discussion forums, they'd nuke threads talking about how to disable that software. So, in the end, people just started giving the best possible feedback regardless of the team or manager performance. I never really needed those threads, all I needed was tcpdump and then blocking its domain in the hosts file :)

estimator7292 1y ago
That sounds absolutely horrifying
- bsjaux628 1y ago
  The behavior is Org and department specific. What happens is that those questions are map to a 'Org Health' metric (satisfaction, innovation, etc) and they are Manager aggregated, so your Manager's manager saw those report and your Director saw your skip manager's and so on. I would say my org was very healthy in terms of handling it, no treaths or anything, just asking us what we thought was going wrong, how to improve and coming up every year with a new SOP to do the connection's review. Again, YMMV.
gusgus01 1y ago
Somehow this and the parent both represent Amazon. Daily questions and a yearly survey that security had to assure us was legit.
eru 1y ago
> So, in the end, people just started giving the best possible feedback regardless of the team or manager performance. That seems to be the best possible strategy for any feedback you have to give as a captive audience? Reminds me of the feedback German companies are forced to give about their employees. It's like a formal letter of reference, but you can and will be sued if you you anything negative. Consequences are as you would expect. And because there has been an inflation in how complimentary these letters are, people started suing when their letter wasn't flowery enough, because that somehow could be read as an implicit criticism. (Just like how A is a bad mark, when everyone else gets A+.)

red369 1y ago

In New Zealand, there is a long list of companies who need to reach out to a large number of current and former employees, and try to convince them to go to a website and enter sensitive information to receive some money (1). Where I'm working, we found it hard, even for current employees, to convince them that it's not either phishing, or a phishing test. This is getting off-topic, but I found it interesting so I'll include more details anyway. In a lot of cases, all the fuss is to return amounts that are tiny, and yet the companies need to keep reaching out and trying to convince people. I got $0.06 (2) from my current employer. Because I've moved countries with them, I ended up falling in the category of needing to provide some bank/tax details. Of course, I wanted to log in with the silliest OS I could think of to test/mess with the tracking dashboard, and so somehow I managed to enter my DOB wrong, which even further increased the back-and-forward and emails involved (I was in the project, so the Payroll peeps involved probably didn't hold it against me). The re-calculation which led to the payment actually worked out that I had been underpaid in come calculations, but overpaid by far more (although still very, very little) in others. The company believed they couldn't offset, so all the fuss was for a tiny amount, which I felt I really wasn't owed anyway. Also unfortunate, was that if any former employee didn't bother to claim the amount because it's so small it's not worth the fuss, it just leads to more work in follow-ups. New Zealand Holidays Act is quite an interesting area in general, in a how-can-it-possibly-be-this-hard kind of way. I think it contributes to the reputation of NZ payroll being one of the trickiest in the world. 1) https://thespinoff.co.nz/business/27-06-2019/cheat-sheet-what-went-wrong-with-our-holiday-pay https://thespinoff.co.nz/business/27-06-2019/cheat-sheet-wha...

JaggedNZ 1y ago
Or IRD (NZ tax dept.) a few years back sending out a survey on a .co.nz domain. Gave their security team a hard time for that one!
- Nition 1y ago
  IRD's phone calling campaign about enabling two-factor auth was also not great.
eru 1y ago

bryanrasmussen 1y ago

noted for my phishing business: track first phishing attempt, send follow up email two days later saying the first one was legit.

thinkingtoilet 1y ago
Note, this only worked because the follow up email came from the head of the division.

noduerme 1y ago

This is hilarious. I wish I'd thought or doing it to my 85 year old father. Maybe I could have saved him the last 10 years of following spam email links into hellish conspiracy holes and identity scams. It didn't matter how many times I told him never to click on an email. There should be a white hat phishing service you can hire to target your elders. Then when they give up their social security number, someone shows up at their door with a big cake with all their personal details in frosting.

ozim 1y ago

That's actually super funny and it is not first time I see quite the same story. They train people not to click links and then someone in management is fucking stupid enough to pull "just send an email with a link" kind of crap instead of properly planning the communication in advance by telling people that there will be a survey, what will be the company that is sending it, when they should expect it - but that just "too much work". I would fire that kind of clown ass on the spot for not doing their job.

janc_ 1y ago

Doesn't help that most surveys are on external unknown domains, and look very suspicious (tracking codes, etc.). I get such links to surveys & other commercial bullshit from my bank too, like they want to train you to click fishing links…

maccard 1y ago

I had a similar experience. I got pulled up for not completing my anti phishing training. It had been sent from a third party contractor with a random domain, but apparently I was supposed to know that was safe but the other external links were bad.