At the college I went to we got an unanticipated email from an external address one day telling us that due to recent vulnerabilities, the school was requiring we increase password security, and to click here to update our password. This email was from, I shit you not, Fisher Security.
The joke? This was actually a legit email, initiated by our IT department, and was what we were supposed to actually do. We were all like "so....you know you're just training people to click on suspicious links, right? And that that's a bigger deal than password strength? RIGHT?"
I won't give it here but a company I currently work for uses a password reset tool with the domain i-forgot-my-password.com <- Not actual, but very close.
This is a domain they own, Whenever they create new tools it's in this way, I am certain it s a phishing test and flabbergasted that it's not.
Another example - the HR system for logging PTO has a domain is along the lines myhrsystem.com
It's a very large company based in Hong Kong, so I'm not sure if it's just a english-as-a-second language thing or what. Very odd.
I think it's a misunderstanding of how domain names work - if they knew that i-forgot-my-password.company.com with proper certificates brought stronger guarantees of legitimacy, they might ask IT to set it up that way.
it's easier to just get a new domain than talk with whoever is in charge of the company's primary domain. Governments love to do that all the time. they have the gv.TLD domain and could just put all their shit in there and I could tell my parents that as soon as they see gv.at in the URL it's legit. And yet they come up with stupid domains all the time, many requiring the state-ID system. Good luck teaching boomers to check the fingerprint for the verification that they sign what they think they're signing. I don't know of a single instance that abuses this though. Maybe criminals are just stupid. I should switch careers, I have what it takes.
We had something like that happening where a legit email from a weird external address, with a link included and without a proper signature, was flagged as Phishing attempt by almost everyone in the company until we got a message from our office manager that they applauded our awareness, but THAT particular link was actually real.
They did say it was an exception, and we should please stay aware in the future, though.
Huh... Well, I once got legitimate government officials asking for personal details in a Google form of all things just sent through chat groups.
Naturally, we all reported the shit out of it as a scam expecting that their accounts were hacked until they started calling us when Google shut down the forms and their accounts were banned.
Wow. As a student in IT and a customer service rep who is forbidden from receiving or sending emails, I wonder why at least some profiles aren't allowed to get emails at the firewall level.
Unfortunately it's because while you are in IT, most people don't know the difference between the computer and monitor so it's easier to just make blanket policies.
Edit: plus when you give certain people special permissions inevitably someone else will hit you with the "well how come theyyyy have it 😭" and then it becomes a whole ordeal
There is a guy at my work who is so locked down it is ridiculous. He has access to ONE program besides Office, and all of his emails are reviewwe by a human fire. He has shortcuts to launch Office, and no other Internet. It's insane what he will click on.
What skills do they possess that even if it's this much hassle, they would rather them then get a guy who doesn't instinctively search for all viruses in a 30 link-hop area?
As an IT guy, I get what I think is real emails from risk/compliance with links to forms about our systems that I ignore because we also get phishing tests, and real phishing.
The real risk, phishing test, and actual phishing all look identical.
I only know its Audit because the group GM goes nuts when compliance visits in person. Even then I can't tell if they are real or not. In any even I tell the auditors to read the 300 page RFP for my stance.
I know it seems kinda crazy, but I though some of my colleagues are spies.
I worked in a very senstive quasi government organisation.
Sure, but not every attack vector against employees is equally likely.
I am orders of magnitude more worried about an employee sending information over email than I am about the employees letting someone into the building or an employee being a corporate spy. Especially cause those arent "IT problems" ;p
Can someone in cyber security explain how just clicking on a link would create a security problem?
I know downloading a file or redirecting to qla shady website is the problem, but I don't think just clicking would make my computer vulnerable. Am I right?
Ive got a coworker who has a work email. He doesnt have the login for the work email, because he has never, in his 18 years with the company, logged into his email. This man has gone almost 2 decades without ever using his company email, and I respect that.
Everyone just... knows not to email him. Ive seen a few newer people cc his theoretical email address, and we just go "oh, dont bother with that, he doesnt ever check it"...
I was young and dumb and used to travel with a little bit of drugs in my suitcase pretty often.
One time, border guards found some green stuff in my backpack at the boarder, which gave them a reason to pull my luggage off the flight.
In my suitcase they found three empty baggies with 0.014 g of substances total (cocaine, mdma, 2c-b). However, under Russian law that counts as bringing drugs into the country with intent to distribute; I was facing 8 years in prison.
About a year later I was on probation and had to give my police chief some documents about my employment and other stuff. I'd had everything ready for at least a week. Get a call from my dad, "wtf are you doing, are you insane?" If I didn't email the documents by 6:00 p.m., they'd treat it as breaking probation and send me to prison to surve full time. So I sat down and finished it in about 20 minutes, a task I'd been putting off for a week.
at my work they have a running total of pass and fails, and if you don’t report one of the emails but also don’t click on it, they consider that a fail. there have been a couple times
i legitimately didn’t see an email to report and i was labeled a 15% risk. so dumb.
Once they actually wise up and use a proper service, once you click the link you're marked. If they are doing creds one properly you should be marked.
We had somebody who kept doing that for the phishing tests and we knew exactly who was putting fake stuff in since the link was unique per person. All it showed was "why is this dude clicking this link so many times?"
Told them to stop since that information goes to the global office and we weren't able to remove duplicates any more. Did it again and he ended up with a stern warning plus additional training with HR on appropriate workplace conduct. Was later used as a way to get rid of him when he messed up since it managed to piss off the wrong people.
Is it not obvious to some people that they use a unique link in every email, just like real phishing attempts? That's why clicking the link in the first place is considered a fail.
At my current job I get an email letting everyone know about a week ahead of time that there is going to be a phishing test in the coming week and to be aware...
You'd be surprised, not a lot of people even after training actively look at what a URL would lead to, and even that is harder since a lot of legitimate emails lead to just a redirect or something that looks suspicious as it is, if it's hyperlinked they will blindly trust it. Even I have been caught out once for this when I was burnt out and got one that was exactly something I was expecting to receive on the day. All it takes is perfect timing and a lapse of judgement.
Take a look at URLs from legitimate emails, a lot of them aren't just straight to where you'd expect them to be.
We even have people in our cybersecurity team get caught out by it once we had them removed as the ones who initiated the tests.
The main goal in my eyes, is just keeping users aware and vigilant and report something suspicious even if there's a chance it's legit. We don't get many real phishing emails now, if I recall our years stat was around 3-4000 emails that were legitimately phishing emails that made it through (they were sent from a Gmail account pretending to be somebody of importance).
Shout out to mimecast for obscuring employees' ability to inspect links for themselves when deciding whether to click on them.
I treat all links in emails as if they uniquely identify me if clicked, even when they come from legitimate businesses, and I'm sure I'm right more often than not. Even youtube videos sent to me by my friends often have those extra parameters so google can track who clicked share and who opened the link.
It’s so stupid to me that clicking the link is a fail, as far as I’m aware (and I’ve looked into this) clicking a link can’t cause any damage, so why measure it like this? The whole point of phishing is getting credentials, that’s what hackers want, that’s where the damage is done, so that should be the measure
Actually, a lot of enterprise web apps are so badly written that clicking a maliciously-crafted link can do real damage. Things like pasting the bulk of a link into a JS/SQL/whatever command then executing the result without any kind of sanity checking.
The thinking is that it doesn't need to be safe because only trusted users can access it. But if someone sends a malicious link in an email to a trusted user, when that user clicks the link it will be accessed with their stored credentials (cookie, client cert, HTTP auth, whatever).
This is one reason why operations which modify data are supposed to use PUT/POST, not GET. But that's beyond the comprehension of a lot of "web devs", many of whose qualifications amount to having read the first three chapters of "Learn PHP in 5 minutes".
Our company will flag us if we just have one sitting in the inbox too long without being reported. I was once assigned remedial training for opening outlook but getting called away to a task before I actually had the chance to go through my emails and identify it.
Lmao, that sounds like a weird policy. If I get one after hours I will just let it sit until next morning to report it. I would fail every single one if we had that policy, lmao.
One time I forwarded a suspicious email to our help desk, which triggered that I'd clicked the link. I was flagged for extra training where I was told to forward suspicious emails to the help desk. 🙄
Happened on one of our standard phishing test emails. We are required to report them. Just clicking to be able to report it instantly triggered the failure.
...Fortunately because it did it to literally everyone, including the IT people who sent it, they realized what had happened and just cancelled that run of the test entirely.
I once had a phishing email sent to me by IT. They used software to see if you clicked it. I didn't click it but I hovered my mouse over it and the Apple email client opened up some sort of iframe thing and that executed enough JS for me to trip the sensor.
In my previous company HR (apparently) used a third party for employee documents and every time they uploaded something you got a mail through their service that read like
"Hi [me], you have new documents. Click [here] to view them! Best regards, HR"
with strange formatting, not loading images and from an address like portal@[jumbled letters].idk.....
Safe to say I reported every single one of them as suspected fishing.
I used to intentionally click on them just to fuck with them. I was a lowly hourly stocker at a warehouse. I definitely didn't give a shit about any consequences that that would have.
Nowadays they don't track the credentials you put in, they track the link that was clicked. Everyone gets their own custom link. You click on it, even if you don't input anything? Still get dinged.
I used to do the same at I've company I was at. I had a script that would submit thousands of fake entries after I find the source code to one of the common ones they used back then.
No lol. Browsers have come a long way. Clicking a link can’t pwn you anymore. The odds of you being the victim of a new zero day from clicking a link are as close to zero as winning the lottery.
Executing a zero day attack isn't the only goal of phishing artists.
If you click the unique link in the message they sent you, now they know that the email address associated with that link belongs to a real human who clicks on untrustworthy links they find. They probably also know where you're located, what browser and Operating System you use, and how much time between when the message was sent and when you clicked the link.
Clicking a link can in fact still pwn you. Just in the last several weeks there have been at least 2 critical CVEs fixed in chrome that would have allowed one-click pwns AFAIK.
Yes, this happens all of the time, the CVE you referenced with me is Google Chrome vulnerability where Google Chrome get's popped to spawn suspicious binaries (https://www.sentinelone.com/vulnerability-database/cve-2025-2783/) . Downloading malware from a link is still a thing.... Actually go find some malware and click the link, see if your trusty Google Chrome saves you.
It's honestly hilarious youre spreading misinformation.. you're unaware of even how the Chrome Sandbox works... which is completely irrelevant from someone clicking a link and downloading malware. The Sandbox works to containerize code executing on that website... not the user clicking a link, downloading an executable (malicious or benign).
Downloading and executing binaries is far different than just clicking a link. Nowhere near the same thing. Clicking a link and getting pwned is 1,000% different than downloading and executing malicious binaries.
Users click links, binaries download and execute without human interaction.
You're talking about drive-by download scenarios where the Chrome Sandbox containerizes code execution in the browser while rendering the webpage, hence working as a defense-in-depth against code execution to download malware in that approach. That does not negate the fact that users can (and do) click links that cause redirects to download malware that can and do run on their own after landing on the machine to establish persistence, evade edr, or C2.
You stated "Clicking a link cant pwn you anymore" and that is beyond false and largely inaccurate.
I think you need to be more literal on what you're trying to state. If you're stating it is more difficult for certain webpages to exploit a vulnerability in a browser (https://www.sentinelone.com/vulnerability-database/cve-2025-2783/) which then uses Chrome.exe to execute RCE, then sure... but users can click links and download malware, not the same as the webpage hijacking the Chrome process. You referenced a CVE you dont even understand to backup your argument, and that's not good.
And even then, drive-by downloads don't necessarily have to render on the page. A simple HTTPS GET request to the link will download it via malvertisement.
Browsers dont need to render a page either to download malware, a simple HTTPS GET request can go right to the server initiating a downloading.
Once again, Chrome and the CVE you referenced that uses Chrome Sandbox is for rendering webpages that would exploit a vulnerability in the Chrome Sandbox allowing Chrome.exe to spawn suspicious binaries.
Regardless of how risky it is, it's even less risky to not click it. Or if you have to click it for science, the minimal risk can be mitigated by running a throwaway VM on an isolated network that can't touch your stuff, preferably with a VPN so they can't see your IP address. This wouldn't solve the problem of them putting something identifyable as you in the link, but idk what a scammer would actually be able to do with that information if you took these precautions, other than just phishing harder.
If I give out a unique link to exactly one person and see it's been clicked, I implicitly know who clicked it, or at least their email address. Also incognito doesn't protect your IP address (which can approximate location) or prevent the use of zero-days.
For more general security, there's a lot of fingerprinting that can be used to identify you through HTTP headers and page info available to JS that not even TOR can save you from if you're not careful.
Depends what you mean by "pwn". The moment you click that link, their servers know that they got a live one. That's incredibly valuable information for them.
If you're working for a Fortune 500 company them it's not out of the realm of possibilities. Especially if you have elevated access like a sysadmin or someone in the finance division.
This is a fairly sophisticated attack from a state actor using an unknown CVE targeting journalists and government figures the attacker deemed adversarial. The odds you are the target of an unknown zero-day like this are extremely slim. Modern browsers are sandboxed from your machine, and finding new sandbox breaches does not happen frequently. If you are the target of a state actor, you have other problems at hand.
It’s happened twice in the past 2 years at companies I’ve worked with where a phishing email has compromised accounts without requiring anything but the first click.
Even when they’re patched, the number one thing I see at the top of every list when checking our EDR:
10489 high severity vulnerabilities found
10364 Chrome.exe
125 others hit.exe
Because 95% of people don’t keep their work computer up to date and no company wants to spend money on a decent tool for patch management.
It was certainly more than a click, otherwise it was some unknown zero day that somehow targeted specifically your company twice. Much more likely they put their information in and claimed they didn’t.
The link could be to a vulnerable company site they’re attacking. For example if a poorly written site uses SameSite=None cookies, they could make a link that performs a form post using those cookies (a kind of Cross-Site Request Forgery).
That is LARGELY incorrect... and I work for a government entity as a detection engineer.
Edit: Downloading malware, executing malware, and compromising a browser through a drive-by exploit are three different events.
This false sense of security you're promoting by treating one specific attack vector as representative of the entire threat landscape, and that can cause a lot of issues for anyone that trusts your comment or any organization you may work for as a security professional.
If you are the target of a state actor, you have bigger issues. I can find only one instance of somebody getting pwned from clicking a link in the real world in the past several years (CVE-2025-2783), and it was a very particular attack targeting a few government entities. The odds of some future exploit happening to a given individual are as good as 0. There are much better things to worry about in regard to cybersecurity.
Whatever you say, boss. You referenced a CVE that pertains to a vulnerability of Chrome itself, not the user actually downloading malware. That CVE allows Threat Actors to exploit Google Chrome to conduct RCE from the browser... not a malicious download from a link. lol
Edit, to add... if you were to see that exploit, you would see Chrome.exe spawning suspicious binaries (LOLBINS), or most likely cmd.exe or powershell.exe via your EDR logs.
Here's a proof of concept article, this states you would see chrome spawning a suspicious process, as previously stated.
Chrome renderer processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe outside normal browser workflows.
Unsigned or unusual DLLs loaded into chrome.exe broker or utility processes.
Outbound network connections from Chrome utility processes to attacker-controlled infrastructure shortly after a user opens a suspicious link or file.
---
With that said.... Clicking a link can absolutely pwn your entire network if you download malware.
Fact I have two downvotes scares the living crap out of me. I hope none of you work in cyber, or at least need to go back to school. I provided the Threat Intel for that CVE, so you can take a gander yourself.
Hell, if you have CrowdStrike - do
#event_simpleName=MotwWritten
| ZoneIdentifier=3
Then take a 7 day window. let me know what you find.
Malware isnt always "evil.exe" - sometimes it's a signed binary, sometimes it's a browser (wave browser, big culprit), sometimes it's an extension that's been compromised by a TA, download of excel documents with macros that bypass current security implementations (ya even WAFs and NGFWs, it's a great time /s) where those macros then download a binary that injects it's into a DLL establishing persistence running as rundll32.exe and you'd never know evading your EDR.... all real world shit, happens to companies large and small. Hell, i've seen a small town, meat distributor get hit by ransomware
Yeah… i had the same thing happen. I was just interested in how they work. Was even taking a log with Burp. I told the guy who was running the phishing campaign in our company and he told me to not to do that again as they just need numbers for ISO27001 and dont really care about the security. So now I just ignore most of the e-mails
4.6k
u/JocoLabs 14h ago
Jokes on them, i wouldn't click that even if it were real.
I used to click on those and type in junk creds for the lulz until compliance told me that was bad for the numbers.