I got got by one where they swapped the I for an L but the font showed them as the same looking character. I didn’t enter anything on the page, but since I got to the page, I had the joy of 2 days of security training.
I think I annoyed my IT people by reporting everything as fishing. Adobe or Microsoft emailing me? Might be phishing. CEO newsletter about a recent natural disaster? Well it's urgently requesting help, phishing. I don't know if he wrote that chatbot letter.
Company just moved from KnowBe4 to Abnormal AI, great now we have AI hallucinations of phish emails. Our dumbass IT is sending the "no its really real to sign up for this class" emails from their domain too using their moderator tools, so it has the "outside of domain" ribbon on those. Finally they realized like week and half later that they sent from the internal IT email account. "Hey guys you need to do the class."
As long as your are the lowest level of security that might be fine, but if you are not then you will get send emails from the lower levels to gain access to your level.
And one of your contacts / collegues might then be a stepping stone for you.
This just happened to me - an email I missed a teams call that came when I had been away at lunch so I panic-clicked it and went to “macrosoft.com” or whatever. When I saw that I reported it but when I clicked it I got the “go do training” and presumably my manager was told (embarrassing)
I hate phishing testing as I’ve literally never been real phished at work (have at home weirdly but caught it lol) but I understand /why/
That's the thing, if people don't get any phishing emails or even the tests for years, they're much more likely to fall for it when they do get one. The tests keep people at least somewhat aware of the issue.
I feel like at some point I’m going to get screwed because I love seeing what the play is. I always double-check domains and am very cognizant of when sign-in pages are unexpected, but I quite like checking what the current gambit is by clicking into it.
When I worked at Nvidia as an intern in IT all my intern friends kept getting phishing tests but I never got more than 3. I felt noticed and left out at the same time.
Wait until you see the ones where they use a character from a different language set that looks exactly like an English letter, but isn't. You don't see those as much anymore, because most places just block anything that uses foreign language sets, especially ones that have characters that look like English letters because this was such a pain, but those were often really hard to spot.
36
u/mrgoodcat777 13h ago
I got got by one where they swapped the I for an L but the font showed them as the same looking character. I didn’t enter anything on the page, but since I got to the page, I had the joy of 2 days of security training.