5 ms·

I work in security and have even performed phishing simulations. Want to know how to get me to click on your link? Send me a newsletter mail with an unsubscribe

I work in security and have even performed phishing simulations. Want to know how to get me to click on your link? Send me a newsletter mail with an unsubscribe link. I will click 100% of the time no matter how weird the domain looks. (I won't enter credentials or download any files though.) Corporate recently told me I'm specifically not allowed to unsubscribe from newsletters (probably for this reason), so now I have set up mutt to open links in a containerized browser, but that's as far as I'll go.

MountDoom 1y ago
The idea of not clicking on links is frankly preposterous. The company pays you to click on links in emails; it's the nature of your job! And it's also core to how we use the internet in our spare time.
CyberHoot-Craig 1y ago
One of the reasons IT doesn't want you clicking on Unsubscribe links is they have been turned into malicious Session Token stealing attacks. Hackers subscribe an victim to dozens of newsletters, many of which do not follow netiquette of sending a confirmation email for you to confirm your desire to receive the newsletter, or worse, the confirmation email contains a second Session Token stealing attach which you are even more likely to click on because you DID NOT subscribe to begin with and your hackles are up... so you click and BOOM, Business Email Compromise! It's happened on a couple of incidents I've been a part of earlier this year and led to 1000's of dollars in Wire Transfer losses! Banks have to add MFA to all Wire Transfers (but don't - Credit Union's are you listening here!!!). So, there's good reasons not to trust unsubscribe links. If you didn't subscribe, and there's no clear confirmation email from the domain in question, report the newsletter as SPAM and block. Notice: I'm a virtual CISO at CyberHoot (and co-founder here) providing security program development and Incident Response services.
evolvecomputing 1y ago
I use to always click on newsletter unsubscribe links too. Then I wondered if they were taking a shot in the dark at a real user on the end of my email and me unsubscribing confirmed it. Here's what I do now. If I don't remember ever subscribing to something, I look for the Unsubscribe button in the email client, which is part of the headers. It feels a little less "phishy" than the link in the email. It uses the message’s hidden “List-Unsubscribe” header, thus no tracking.
- mr_mitm 1y ago
  Me too, I even set up mutt such that it shows that header in pink in the default view, and a hotkey that opens that link in firefox container.

MountDoom 1y ago

The idea of not clicking on links is frankly preposterous. The company pays you to click on links in emails; it's the nature of your job! And it's also core to how we use the internet in our spare time.

CyberHoot-Craig 1y ago

One of the reasons IT doesn't want you clicking on Unsubscribe links is they have been turned into malicious Session Token stealing attacks. Hackers subscribe an victim to dozens of newsletters, many of which do not follow netiquette of sending a confirmation email for you to confirm your desire to receive the newsletter, or worse, the confirmation email contains a second Session Token stealing attach which you are even more likely to click on because you DID NOT subscribe to begin with and your hackles are up... so you click and BOOM, Business Email Compromise! It's happened on a couple of incidents I've been a part of earlier this year and led to 1000's of dollars in Wire Transfer losses! Banks have to add MFA to all Wire Transfers (but don't - Credit Union's are you listening here!!!). So, there's good reasons not to trust unsubscribe links. If you didn't subscribe, and there's no clear confirmation email from the domain in question, report the newsletter as SPAM and block. Notice: I'm a virtual CISO at CyberHoot (and co-founder here) providing security program development and Incident Response services.

evolvecomputing 1y ago

I use to always click on newsletter unsubscribe links too. Then I wondered if they were taking a shot in the dark at a real user on the end of my email and me unsubscribing confirmed it. Here's what I do now. If I don't remember ever subscribing to something, I look for the Unsubscribe button in the email client, which is part of the headers. It feels a little less "phishy" than the link in the email. It uses the message’s hidden “List-Unsubscribe” header, thus no tracking.

mr_mitm 1y ago
Me too, I even set up mutt such that it shows that header in pink in the default view, and a hotkey that opens that link in firefox container.