724
u/lraviel381 8h ago
Oh sweet. I hate tests. Click
→ More replies (2)144
u/Teripid 7h ago
Congrats on your subscription to the uh... "forever in the special consideration group" mailing list. Doh!
19
u/AriaTheTransgressor 4h ago
We're required to fire them after a second failure, but they do receive training after the first failure. We're government though.
→ More replies (3)
985
u/MattCW1701 7h ago
This is why I report every email as phishing. Standup invite? Phishing. Manager 1:1? Phishing. Annual evaluation meeting? Phishing. All hands meeting about our growth this past year? Also phishing.
275
115
78
77
u/Not_My_Emperor 5h ago
Unironically I do actually do this all the time. Mostly because we switched HR platforms and I hate the new one because it BLATANTLY breaks all the phishing rules. So I'm doing it out of spite.
[Someone I don't work] with has shared a PDF with you. Please download here!
Please click on this link to access your pay information.
This was a legit email from them. I get these all the time now.
29
u/17HappyWombats 3h ago
You'd love our leave request system. It's some generic "any dummy can make an online form" site where we have to pick our employee name from a dropdown list (then etc). There's no validation, it just emails whatever you put in to the payroll people.
It also *requires* that you enter leave date and time to the minute. I have been told by mean team leader not to write a script to request a day off sick in one minute intervals.
5
15
11
6
→ More replies (13)5
u/-bubblepop 4h ago
My company was bought and the new company I guess uses a specific training platform, who sent us all a “u should totally pls log in to us with ur AD creds” email. I reported it as phishing because we get like monthly tests now. Well turns out it was real??? lol
146
u/Dang3rdave 7h ago
Best phishing campaign was a "your expenses have been declined". I was on the subway to work and was immediately livid. Taught me a very good lesson that day so kudos to the team.
15
u/cheese_is_available 1h ago
I'm in a cybersec adjacent role and the "sign your new contract so we pay you more" just after raise season got me. Told my manager that maybe if the HR team didn't change their tooling every six month it wouldn't be so damn credible.
22
u/noechochamberplz 5h ago
This happened to me too. I don’t remember what it was, but it was relevant to some obscure thing that I thought only applied to me at the moment. They got me.
3
u/BirchBox96 2h ago
I got fucked by a fake pick your christmas present. It was november and got there before the real one.
339
u/exoclipse 7h ago
the worst one I got was "you have been selected to be in the first wave of a round of laptop upgrades, please click this link to register"
259
u/one-joule 7h ago
Worst one I've seen teased a holiday bonus. It was received about as well as you'd expect.
280
u/BigFatDogFarts 7h ago
That one got damn near 60% of the people I worked with. Almost got me, but as I hovered over to click it I thought "Wait a second, they would never give us a holiday bonus"
96
u/soft_cardigans 7h ago
that's actually such an effective one but it reeaaaaaaally should only be done if theres actually going be one lmao
→ More replies (1)58
u/GlowGreen1835 7h ago
nah, that would require executives to be humans capable of empathy. Unfortunately, those don't really exist.
6
u/aggravated_patty 4h ago
What I’m taking away from this thread is that I should start phishing with holiday bonuses
23
u/exoclipse 7h ago
i hate it security professionals
42
2
19
u/Mattsvaliant 6h ago
Holy fuck I'd flip out. I was pissed when my company sent an phishing test email about how my "misuse of company property" where I allegedly had use my work computer for something personal. But lying about a bonus would probably have me throwing my computer across the room or more likely at whoever heads up IT security.
Centene is fucking evil.
→ More replies (3)27
u/FoodIsTastyInMyMouth 6h ago
Sure, but the issue, phishing attempts do exactly this so if people aren't trained that it's a possibility then yeah you're more likely to get done in...
→ More replies (5)2
38
u/Barkalow 7h ago
I got one inviting me to "a document shared by my manager"....on my FIRST DAY OF THE JOB.
7
u/rosuav 5h ago
On the face of it, that doesn't seem implausible? Onboarding often involves a lot of "here, read this doco".
6
u/Barkalow 4h ago
Exactly, thats why I was so annoyed, lol. I never get caught by those phishing emails, I just didnt expect it day one
4
30
u/tankerkiller125real 7h ago edited 7h ago
I work for a small company and I'm responsible for crafting and distributing the phishing email tests (as part of policy and compliance). So far with our software engineering, accounting, support, etc. teams I've only managed to get one or two people (they're very well trained). The sales team though? Just give them a link to an "RFQ" and watch the numbers climb like a rocket.
Entire sales team has had to go through remedial phishing training at least twice this year alone, a few of them three times so far this year (we do it quarterly). And yes, if they get to a fourth there are going to be HR issues because the policies require punishments at that point.
7
u/exoclipse 7h ago
Salesman are perhaps one rung lower than security professionals (no offense)
14
u/tankerkiller125real 6h ago
I'm "the" IT guy, I'm responsible for all the infrastructure, and cyber security and compliance happen to also fall in my lap. (Although it is my formal degree training and what not). The goal is to have realistic phishing and spam emails, ones that look like the real thing, including obvious spelling, language, etc. issues.
The fact that the sales team clicks on literally anything and everything that might even hint at an opportunity to get a sale without thinking about it for more than 2 seconds is a them problem.
And it's not a companywide issue, again, it's one or two people for the entirety of the rest of the company, the salespeople are the only ones that can't seem to get their shit together.
3
19
u/critical_patch 7h ago
My work sent a fake e-card on Valentine’s Day and got like 1/3 of the company with that one
4
u/Mountain-Ox 6h ago
That might have gotten me back when Macs had that terrible butterfly keyboard. Everyone on my team had at least one key fall off.
→ More replies (1)3
u/ClaymoreMine 5h ago
These get reported to HR and Legal. Have fun explaining how heartless you are with them.
108
u/whyliepornaccount 7h ago
Still wont top the only one I've "fallen" for.
On my first day at the company buried into the legit "click here to register your account" onboarding emails was a phishing test saying "click here to register your account". I was so pissed off.
73
u/RIPmyPC 6h ago
Reminds me of my on-boarding. Right after they tell us the signs of a phishing attempt and to not trust any link from outside the org and even be wary of links from other departments you don’t interact with, they hit me with “click here to do your mandatory security awareness training” coming from a random esupport email going to a KnowBe4 link. Of course it also had “you have 1 week left to do it!” Clear signs of a phishing test for anyone not familiar with the sites.
It was so sketchy I had to google the website and login from there. It was real.
I actually made an IT ticket to complain that it made no sense for a company that big to offer so little info on what emails you’d actually receive in your first day.
18
u/kemikiao 3h ago
man, FUCK KnowBe4. They have to know their goddamned emails look EXACTLY like the shit they're "training" us to detect. Our IT has to send out a heads up email to tell us the KnowBe4 email is coming out because pretty everyone reported it as spam the first couple of times.
7
u/aaroniusnsuch 2h ago
Just create an inbox rule to check headers for KnowBe4 and classify those as "phishing test." Then you can still read it and report it but you notice the color/flag first.
32
u/TheNewYellowZealot 5h ago
I just report those ones as phishing anyway and make my company waste their time to investigate if it was phishing.
13
u/17HappyWombats 3h ago
One bank I dealt with does that and I always reported their garbage as phishing to their security team. I changed banks after a bit because they kept replying with "no, you have to click the mebank.sdfkjhsdfkjghsd.....dodgyscum.com.au link to confirm your tax details with us".
6
u/EnoughWarning666 3h ago
At a place I used to work I got an email about cybersecurity training. I had no desire to waste a couple hours on their inane training when I likely know more than the person that wrote the training, so I just deleted the email and was going to say I thought it was a phising scam if asked about it later.
A month later our manager call everyone in the office (about 5 of us) into his office to tell us that IT was wondering why nobody had even started the cybersecurity training. Turns out ALL OF US had the exact same thought process! No one wanted to do the training, so we just deleted it and all claimed that we thought it was a phising scam! We had a great laugh about it. Manager told IT to send out another link and we'd do the training. All but one of us just deleted the next email too. Never got asked about it again after that.
→ More replies (1)21
u/Acogatog 6h ago
this one’s total bull imo, there’s no way that someone sending you phishing emails could know it’s your first day, is there? Phishing emails are supposed to cast a wide net, not catch people in highly specific scenarios.
21
u/WigWubz 5h ago
Probably just a law of large numbers thing. Mail got sent to a large group, for most it was obviously fake. For a select few it happened to be specific enough to catch them.
I got caught out by a fake invite to a teams channel with the word “planning” in the title a few hours after I legitimately got adding to a “planning” group. Opened the email on my work iphone so the email formatting was completely destroyed like usual, and the send address was truncated. Clicked the link and it asked me to log into teams, an obvious phishing flag *except* I had literally just reset my password and so was expecting to be prompted to log in the next time I opened the app…
It hurts cus I know it’s a legitimate fail. The red flags were there and I missed them. But, if you weren’t in the very specific circumstances I was in the flags would have been way redder. I was primed to fail the test in a way that the people setting the test could never have predicted. But that also just means that I was primed to fall for an actual phishing scam in that moment.
10
u/PalmTreeExpert 5h ago
Someone at my college had their SSN stolen when they got a call saying there was a mistake with their info and asked for them to repeat their information. This was as they were on their way home from the social security office after getting their card…
It is technically possible, but yeah typically phishing is relatively vague/open to a wider audience.
9
u/KFindar 4h ago
The highly specific ones are called spear phishing
https://www.kaspersky.com/resource-center/definitions/spear-phishing
→ More replies (2)2
u/butholesurgeon 4h ago
Depends on how fresh the data export that the scammers bought is
Maybe it was snagged a day before?
A lot of data exfiltrations just get listed for sale for anyone who cares to buy it and find something useful out of itInsanely unlikely but it’s not IMPOSSIBLE
→ More replies (3)4
u/Good_Policy3529 6h ago edited 5h ago
This is why I'm happily 37 security training modules behind. I get an automated email every week telling me I need to catch up on my modules, click here to view incomplete modules. And my defense if anyone actually ever calls me out is "oh, I thought those were phishing emails."
161
u/FixFun1959 4h ago
I’ll never forget when I started a new job and got an ema from my ‘boss’ (same name but weird @), with a link saying to check out this excel spreadsheet.
Her office was next door so I popped my head around said ‘hey did you send me some excel sheet?’ And she said ‘yeah take a look’.
So I clicked on it and it was from IT saying I failed the test and a link to phishing training.
I went back to my boss like ‘wtf? Did you know that was a test?’ And she said ‘yep, and you failed. Looks like you need more training.’
I took the time to check and verify before opening/reporting it. And she lied to me for some reason, a ‘gotcha’ or something. So fucking weird.
🙄
99
u/MothMatron 3h ago
I’d have either:
A) made a explicit mention of the incident to the phishing or IT team in that it has come to your attention that your boss has shown herself very likely to blindly instruct subordinates to open malicious emails, some bearing her own name thus believing she even sent them herself when she in fact did not, potentially forcing the hands of multiple employees into compromising several devices and user accounts all at once.
B) Never open any email she sends you ever again and if she ever comes asking, you can fake naïvety and claim that you cant trust that any of these emails are in-fact authentic, so she should bring you documents in physical print.
→ More replies (1)19
60
u/LutimoDancer3459 3h ago
Asking the person directly is one way you should handle such mails. She is just an idiot...
24
u/VorionLightbringer 2h ago
You did it right though. You confirmed via another channel if this is true. Maybe your boss needs more training.
24
u/LightofNew 2h ago
Reply that you did not fail the test and opened an email from your boss she confirmed that was valid. That's basics 101. You can't never open an email.
15
u/M4rshmall0wMan 1h ago edited 1h ago
The fuck? Is a real hacker gonna somehow hack your boss' brain and make them verbally trick you into falling for a scam?? Asking for verbal confirmation is literally the correct way to catch a scam. If your boss were somehow compromised, that would be on them, not you.
This is so unrealistic and they're teaching you the wrong lesson.
→ More replies (3)3
13
9
u/Adventurous-Spend341 3h ago
Lmfao, wtf. I would never stop thinking about this if this happened to me 😂 like it’s bad in a way if your boss does this you should not work there but it’s also so absurdly petty in a way that I can stop laughing about this
→ More replies (1)5
u/MauiMoisture 1h ago
Lol that's fucked up. I actually failed a phishing test my first month on the job. I was scared something would happen but no one ever mentioned it. I then passed another one like 8 months later.
56
u/Positive_Mud952 7h ago
I got got on one of these, once.
They sent out an e-mail shortly before Halloween, warning about inappropriate costumes, with a link describing itself as an album of past examples we shouldn’t wear. The link was purple, the visited color.
I thought to myself, “When the fuck was I dumb enough to click on this?” and clicked. Before the “you failed” page even loaded, I got out an, “Oh goddammit.”
→ More replies (1)
31
u/Majestic_Ad_7133 7h ago
The sad thing is that this would probably work for my organisation. Mandatory tests here means once a month.
13
u/AvonMustang 7h ago
Once a month!
Ours are very random. Sometimes nearly a year between and the like three in two months. Only exception is we have a security awareness month and everyone is guaranteed to get one that month.2
63
u/AriaTheTransgressor 7h ago
I'm the dev department head, I don't read messages from IT ever (so they've never caught me in their phishing tests) because they know where I am and if it's important they'll come and tell me.
This doesn't mean I'll never get caught in a phishing scam, just that the test doesn't work on entitled managers.
40
u/Vahldaglerion 7h ago
our head of dev said that if we get him, he’d buy the department pizza. i’ve been trying for 3 years now lol
→ More replies (1)31
u/FlashSFW 6h ago
Buy the pizza. Insert cupon prize for discount on the next pizza with a qr code in the box and make him scan. The webpage it leads to say "you're paying this one".
6
u/wbrd 6h ago
This is beautiful.
6
u/Plants-Matter 5h ago
Except for the fact that you wouldn't scan a coupon for your next pizza until you intend to buy pizza again.
And also the fact that if your coworker brought a pizza in, it makes no sense for the boss to scan the coupon.
I have a feeling you get phished a lot.
2
u/Mundane-Mud2509 6h ago
Wouldn’t they send phishing tests from external emails?
6
u/AriaTheTransgressor 6h ago
I don't even look at external emails because they shouldn't be contacting me in the first place. My department director (over IT and Dev) deals with outside vendors and contractors and there shouldn't be another external component to my job.
→ More replies (1)→ More replies (2)2
u/Retrograde_Bolide 5h ago
At where I worked, yes. IT was told to make an inbox rule to send all external emails to a seperate folder. Never saw a phishing email after that
27
u/mrgoodcat777 7h ago
I got got by one where they swapped the I for an L but the font showed them as the same looking character. I didn’t enter anything on the page, but since I got to the page, I had the joy of 2 days of security training.
12
10
u/Successful-Engine623 5h ago
I just stopped answering emails from outside the office….or not on my contacts
17
u/UnDispelled 4h ago
Amateur, it could be an insider threat.
I don’t answer any emails
6
→ More replies (1)5
3
u/zman0900 5h ago
Mine puts a special header in the phish test emails, so I just up a rule to report and delete them automatically.
→ More replies (2)3
u/realmauer01 4h ago
As long as your are the lowest level of security that might be fine, but if you are not then you will get send emails from the lower levels to gain access to your level. And one of your contacts / collegues might then be a stepping stone for you.
3
u/IgnatiusRileyFreeman 4h ago
I think I annoyed my IT people by reporting everything as fishing. Adobe or Microsoft emailing me? Might be phishing. CEO newsletter about a recent natural disaster? Well it's urgently requesting help, phishing. I don't know if he wrote that chatbot letter.
→ More replies (1)→ More replies (2)2
→ More replies (5)2
u/-bubblepop 4h ago
This just happened to me - an email I missed a teams call that came when I had been away at lunch so I panic-clicked it and went to “macrosoft.com” or whatever. When I saw that I reported it but when I clicked it I got the “go do training” and presumably my manager was told (embarrassing)
I hate phishing testing as I’ve literally never been real phished at work (have at home weirdly but caught it lol) but I understand /why/
5
u/Sibula97 2h ago
That's the thing, if people don't get any phishing emails or even the tests for years, they're much more likely to fall for it when they do get one. The tests keep people at least somewhat aware of the issue.
→ More replies (1)
17
u/JimboTCB 1h ago
I got a "phishing test" email from our IT department last week which straight up said "this is a phishing test, do not click any of the links below, please press the report button in your email client" and TBH that one made me second guess myself way more than any of their previous tests or any actual phishing emails had.
15
u/karkonthemighty 2h ago
Back when I used to help run an eBay store, we took great delight in the phishing emails we got. We used to rank them on how close the formatting of the email looked like eBay emails, how close they got to an official eBay looking email, etc.
We did this because we sold used corporate IT equipment, and the boilerplate phishing email was based off a customer eBay email demanding a certain colour or size of an item, like you would if you were selling clothes.
I can't sell you a medium RAM in purple miss, because that's not a real thing.
4
2
u/purinikos 17m ago
The client is always right. Besides, sell them an RGB RAM kit and help them sst it up to purple /j
14
13
14
u/robin_888 7h ago
At work I have an email filter implemented that sorts these phishing tests into their own folder, so I can read them on Fridays.
It filters on the URL of the tracking pixel at the end of each e-mail.
10
u/External_Touch_3854 4h ago
Can’t fall for the phishing email if you never check your email
https://giphy.com/gifs/5XELueHTZd3XCaMGbw
11
u/razzemmatazz 6h ago edited 4h ago
I'm still pissed about the phishing test announcing big changes to the healthcare plan and linking to the new portal, 3 days after they announced huge changes to the plan and swapped to a new insurance company.
→ More replies (2)9
u/Livid_Technical_Pand 2h ago
But like that's a completely reasonable way a bad actor would try to phish people. All it takes is 1 employee posting about the upcoming healthcare plans on social media (like HR glazing themselves) and attackers now have a plausible reason to be in your inbox.
10
u/rapratt101 4h ago
I failed one because iPhone automatically previews links if you click and hold to view the full URL, exactly like we were trained to do before clicking. So… that sucked. Plus the CSO is my father in law and he berated me (good naturedly) for failing his test. He didn’t care about my excuse.
11
u/-Redstoneboi- 4h ago
so basically iphone itself fails the test? what's the workaround
→ More replies (5)2
9
u/Due-Consequence9579 6h ago
For the phish tests to get past their edge filters they have to add an SMTP header exclusion.
Outlook (and any other reasonable client) can move things to the trash based on SMTP headers.
You’re welcome.
7
u/clipsracer 4h ago
Indeed. I filter out anything with “x-phishing” in the header has worked for me for years across 3 organizations. Somehow I’m the only person in a 50k organization that’s never clicked on a phishing test.
→ More replies (3)→ More replies (1)3
u/wengla02 4h ago
Except when the phish testing system *directly injects it into your inbox*, bypassing the entire SMTP system.
→ More replies (3)
38
u/penguin444 4h ago
I ignored the phishing emails completely.
Then one day I got an angry email that pretty much said "You did a good job not clicking on the the fake link, but you failed the test because you didn't report the phish."
Seriously?
35
u/YourUglyTwin 3h ago
From an IT Consultant's POV:
You did do a good job not clicking anything actually, here's the issue with just ignoring: You're almost certainly not the only one in the company that got that email, reporting it to IT will help them identify the email faster and remove it from everyone's mailboxes before someone else clicks it by mistake. In my eyes its more a courtesy to your coworkers, an IT shouldn't solely rely on users to report phishing emails. But those are 2 different topics in terms of IT fighting emails.
3
u/IwasThereIsawIt2 3h ago
Heres my POV, I dont check my mail that often due to having a not office setting and being an employee who does not place orders or emails vendors. Im just a guy who comes in to work, does workorders and then goes home and be sad, hope that clarifies things
→ More replies (10)→ More replies (2)2
u/hazeHl49 1h ago
What else would you rely on as IT? Like once the phishing mail arrives on the coworkers desktop, you'll need them to come forward with it
→ More replies (2)12
u/John_Tacos 3h ago
Then someone in HR sends an email to everyone that looks exactly like a phishing scam and they get mad that no one filled out their survey.
→ More replies (1)9
u/Effective-Carob-9003 4h ago
Yep, when they get reported the SOC will look for other recipients, and look for forwarding or URL clicks.
I think with these Decision One Models progressing it may make analysing all possible security telemetry arbitrary, but right now if the Phishing attack is from a geniune sender who was compromised, automatic detection is pretty hard, a user base trained to instinctively report phishing is a huge leg up.
→ More replies (4)10
u/JustaSeedGuy 3h ago
Yes, seriously. You can't take the 2 seconds to alert it that your company is being targeted by a phishing scam?
You could help prevent the weakest link in the chain of your workplace from falling for the scam. But instead you adopted a "meh, I'm fine so I don't have to do anything to help anyone else" attitude
→ More replies (9)
7
8
5
u/Adventurous_Run136 7h ago
I actually cant wait for my work place to do these tests. I can't remember how many time account were hacked in 8 years
6
6
u/FixergirlAK 3h ago
At my last job management hired the worst possible security training company. For some reason their notifications of mandatory training looked exactly like their fake phishing emails. They were not amused when the whole company reported the training emails as phishing.
20
4
5
u/jippen 6h ago
Scariest actual phish I saw was for a bank. Hackers found XSS in their help page, reused the bank’s css and stuff to make the login page look perfect. Https://bank.com/help/ in the url bar… with a buncha stuff after.
But the form submitted to a page on a different domain and stole your stuff.
3
u/MiserablePotato1147 6h ago
I'm the jerk who copies and pasted the link in a VPN tab with the GET data stripped out. Sorry not sorry. I'm pen testing your pen test. Go ahead. Fire me.
3
u/masukomi 5h ago
I never got caught by any of my former company's internal phishing attempts simply by being terrible at email and never opening any of it. 😜
3
u/sticky-dynamics 5h ago
The security team posted up a QR code that supposedly linked to some preparation work they wanted everyone in IT to do before some security training. Obviously, I didn't scan it.
Turns out it was legit and I wasted the whole training session just trying to get caught up to everyone who had done the work ahead of time.
3
3
3
u/madmaxlemons 4h ago
We have had more than one “tech savvy” user click the emails on their personal machines that they are not supposed to be logged into and get phished then come crying to our team. I’m sure many of you think yourselves clever as well
2
u/Joker-Smurf 6h ago
No problem.
My script which scans my emails, looking for the phishing test header, would have already caught this and submitted it as a phishing attempt WHILE I WAS STILL ASLEEP!
2
u/jmflyers 6h ago
I had an older co worker that really didn't like this one younger girl on an adjacent team and he would just report all her emails as phishing lol
2
u/Alternative_Swan_497 6h ago
Screenshot and post it on Teams or something in a self-congratulatory manner. Just to see how your IT security team reacts.
2
u/tavirabon 5h ago
If all you have to do to pass it is nothing, you're already on the exemption list.
2
u/supershinythings 5h ago
Just check the headers, find the tag they use to bypass the filters, filter on that tag to a folder, and wait for the corporate phishes to roll in.
I like to report them as phishes so they think they’re helping. I just got tired of them wasting my time.
2
u/Fit_Giraffe_748 4h ago
We all have to do them because the higher ups can't stop clicking on links. Any worker just doesn't even read the mails
2
u/RazorSlazor 2h ago
Oh I gotta show this to our security department. They'd get a LOOOT of hits with that.
2
3.0k
u/JocoLabs 7h ago
Jokes on them, i wouldn't click that even if it were real.
I used to click on those and type in junk creds for the lulz until compliance told me that was bad for the numbers.