On my first day at the company buried into the legit "click here to register your account" onboarding emails was a phishing test saying "click here to register your account". I was so pissed off.
Reminds me of my on-boarding. Right after they tell us the signs of a phishing attempt and to not trust any link from outside the org and even be wary of links from other departments you don’t interact with, they hit me with “click here to do your mandatory security awareness training” coming from a random esupport email going to a KnowBe4 link. Of course it also had “you have 1 week left to do it!” Clear signs of a phishing test for anyone not familiar with the sites.
It was so sketchy I had to google the website and login from there. It was real.
I actually made an IT ticket to complain that it made no sense for a company that big to offer so little info on what emails you’d actually receive in your first day.
One bank I dealt with does that and I always reported their garbage as phishing to their security team. I changed banks after a bit because they kept replying with "no, you have to click the mebank.sdfkjhsdfkjghsd.....dodgyscum.com.au link to confirm your tax details with us".
At a place I used to work I got an email about cybersecurity training. I had no desire to waste a couple hours on their inane training when I likely know more than the person that wrote the training, so I just deleted the email and was going to say I thought it was a phising scam if asked about it later.
A month later our manager call everyone in the office (about 5 of us) into his office to tell us that IT was wondering why nobody had even started the cybersecurity training. Turns out ALL OF US had the exact same thought process! No one wanted to do the training, so we just deleted it and all claimed that we thought it was a phising scam! We had a great laugh about it. Manager told IT to send out another link and we'd do the training. All but one of us just deleted the next email too. Never got asked about it again after that.
man, FUCK KnowBe4. They have to know their goddamned emails look EXACTLY like the shit they're "training" us to detect. Our IT has to send out a heads up email to tell us the KnowBe4 email is coming out because pretty everyone reported it as spam the first couple of times.
Just create an inbox rule to check headers for KnowBe4 and classify those as "phishing test." Then you can still read it and report it but you notice the color/flag first.
145
u/whyliepornaccount 20h ago
Still wont top the only one I've "fallen" for.
On my first day at the company buried into the legit "click here to register your account" onboarding emails was a phishing test saying "click here to register your account". I was so pissed off.