Current Events > Company I work for is going hard on the fake phishing training emails.

(+) Yeah! (+)

I use to get maybe a couple a year. Once you complete your anti-phishing training it would flag your email and within a couple weeks you'd get a test email.

But now they are sending these out every two weeks. It is obnoxious.

Yeah, the site I work at randomly sends them too, but not every two weeks. Maybe once a month.

Or they are under attack by a real phising scam.

i get like 60 a year, it's ridiculous. they are starting to look really really legit also and even come from my org's url. sometimes i get 2 a day!

Maybe only 1 in 10 of the phishing tests I get are remotely believable.

Then again, some of my co-workers still fall for them.

This is going back a bit but my university went hard on these years back and I was praised for never falling for them but even though Im not dumb enough to get scammed by one of them it had more to do with the fact I hadnt opened my work email in 21 years. From 1999 to 2020.

Starting in 2020 with Covid they moved monthly training to online based and once a month I had to login to do the training. If Covid hadnt happened Id be on year 27 of my job with never checking email.

My university does dumb shit like IT will drop off flash drives and leave them laying around and see if anyone puts them in a PC. I work at a power plant and no one ever cares about shit like that. We dont even take notice of it.

archizzy posted...

My university does dumb shit like IT will drop off flash drives and leave them laying around and see if anyone puts them in a PC. I work at a power plant and no one ever cares about shit like that. We dont even take notice of it.

wasn't that trick the way the cia got a virus into iran centrifuges years ago?

monkmith posted...

wasn't that trick the way the cia got a virus into iran centrifuges years ago?

Oh I'm sure it has worked. Hell it has even worked on our university but not at the power plant. We just simply don't care about that type of stuff here. That might work in some office setting but not in such a blue collar place where we are more concerned about steam pressure and making electricity.

I get one at least once a month, sometimes more than that.

I get it though. A hack can end up costing a company a lot of money. They don't really have a choice but to take cybersecurity seriously.

Crimson_Corsair posted...

I use to get maybe a couple a year. Once you complete your anti-phishing training it would flag your email and within a couple weeks you'd get a test email.

But now they are sending these out every two weeks. It is obnoxious.

My secret is I never reply to emails.

The Sales Department got hit with a voicemail that sounded like it came from our CEO. Even got the nickname right for the Sales Department head. Fortunately, no one fell for it. It's the first AI scam that IT has encountered, so ever since they've been stepping up their tests.

At my work I just don't open an email unless its from a coworker or a vendor replying to one of my emails (read: like 10 emails a year). Anything else (company surveys, etc) there's 50 other ways to access. If I get a cultureamp email, I'll just go into the app or wait for the Slack bot to pester me before doing it.

My one coworker taught us his "secret trick" - he'd just open any unexpected email and view the source. Usually you could just control+f "phish" and there'd be a few lines about phishing training. Seemed to work well but kind of overkill.

divot1338 posted...

My secret is I never reply to emails.

The problem is that if you don't flag it as a phish and block sender then it counts as a "failure" and you get a passive aggressive call from the snobbish IT guys.

I didn't even notice I had one in my inbox a couple months ago and I got phone call from them talking to me about the importance of blah blah blah.

I think they get off on this shit.

archizzy posted...

Oh I'm sure it has worked. Hell it has even worked on our university but not at the power plant. We just simply don't care about that type of stuff here. That might work in some office setting but not in such a blue collar place where we are more concerned about steam pressure and making electricity.

point is all it takes is some dumb chucklefuck plugging a mystery flashdrive into some vital computer. there's been fun stories about intrusions into the national power grid for years, and there's a lot of unsecured vital computers manned by dumbasses that could be used to fuck with it.

Crimson_Corsair posted...

The problem is that if you don't flag it as a phish and block sender then it counts as a "failure" and you get a passive aggressive call from the snobbish IT guys.

I didn't even notice I had one in my inbox a couple months ago and I got phone call from them talking to me about the importance of blah blah blah.

I think they get off on this shit.

They literally send these to us all the time. I got one Thursday.

I dont do shit to them and there are no consequences.

I know for a fact if you reply to one you get to take the phishing training again.

Starks posted...

Maybe only 1 in 10 of the phishing tests I get are remotely believable.

Then again, some of my co-workers still fall for them.

I think to myself how dumb do you have to be to fall for some of these. The fact that many must is worrisome

monkmith posted...

wasn't that trick the way the cia got a virus into iran centrifuges years ago?

Correct: Stuxnet

The sad part is they keep doing it because, somehow, people still keep falling for them. It's insane. My last job was literally for a tech company, as an app developer. And just once they had me send out the form phishing training email, since the securities dude was on vacation, and in a tech company, I still got like, 6-7 clicks/replies. It was crazy. And depressing.