2 ms·
It reminds me how at work we had to take a course hosted on our domain about how to recognize phishing and a few days later we got an e-mail from outside our do
by jhbadger 2mo ago
It reminds me how at work we had to take a course hosted on our domain about how to recognize phishing and a few days later we got an e-mail from outside our domain saying we had to take a course about a different subject on their domain. We got an email from management a week or so later that complained that so few people had completed the new training -- because we all assumed it was a phishing attempt because it was exactly the sort of thing the phishing course talked about!
- starky 2mo agoWe have a training thing at work that sends out phishing emails and you are supposed to report them using a handy button in the email app. If they are training emails you get a good job website that pops up. I greatly enjoy reporting every single genuine email that reads anything like a potential phishing email as there is someone in IT that reviews them and probably gets annoyed at the various groups sending sketchy emails for official business.
- AlotOfReading 2mo agoI'm forced to have a relationship with a bank that sends out iPad giveaway emails, where your chance of winning is contingent on filling out a survey with personal information. These occasionally go out on the same day as their periodic "how to recognize scams" newsletter.
- ern 2mo agoA significant number of phishing attempts would be thwarted if email apps had the option to expand the links next to URLs on platforms without mouseover, like mobile.
- LgWoodenBadger 2mo agoOur idiots decided to conduct phishing tests by allowing KnowB4 to send "official" phishing emails. The kind that Outlook/Exchange don't flag as "outside your organization." So now there's no real way to tell what could be a legitimate email from illegitimate. Also, the Knowb4 phishing tests include some Knowb4 headers, so it's trivial to pass the test (though they're usually so stupidly obvious that you'd never need to check).
- voakbasda 2mo agoFWIW, they put a header in the message that you can spot from a thousand miles away. That is how they get past the filters. I used to work for a company y that used them, and this trick was passed around between engineers as a way to tell. They didn’t bother checking the results of whether we flagged them as spam, so ultimately we found that we could just ignore them completely. It’s compliance theater. No real security is gained, but it checks all the boxes.
- pirates 2mo agoAt my company they started placing the emails in your inbox in a way that rules looking these headers didn’t flag them. Except that only seems to be true in Outlook and other email clients flag them just fine.
- ButlerianJihad 2mo agoSomeone here recently asked whether cyber-criminals could land cushy consulting jobs, and the late Kevin Mitnick was no exception. He served as "Chief Hacking Officer" at KnowBe4, among other cushy consulting roles. https://en.wikipedia.org/wiki/Kevin_Mitnick#Consulting https://en.wikipedia.org/wiki/Kevin_Mitnick#Consulting Bonus KnowBe4 fact: they produced a web series from 2019-2024! https://en.wikipedia.org/wiki/The_Inside_Man_(2019_TV_series) https://en.wikipedia.org/wiki/The_Inside_Man_(2019_TV_series... Bonus bonus fact: KnowBe4 hired more than zero North Koreans! https://en.wikipedia.org/wiki/North_Korean_remote_worker_scheme#KnowBe4_incident https://en.wikipedia.org/wiki/North_Korean_remote_worker_sch...
- glaslong 2mo agoEvery official permissions block and exemption request popup our company's enterprise ops manages appears indistinguishable from malware. It's almost impressive.