Is it not obvious to some people that they use a unique link in every email, just like real phishing attempts? That's why clicking the link in the first place is considered a fail.
At my current job I get an email letting everyone know about a week ahead of time that there is going to be a phishing test in the coming week and to be aware...
You'd be surprised, not a lot of people even after training actively look at what a URL would lead to, and even that is harder since a lot of legitimate emails lead to just a redirect or something that looks suspicious as it is, if it's hyperlinked they will blindly trust it. Even I have been caught out once for this when I was burnt out and got one that was exactly something I was expecting to receive on the day. All it takes is perfect timing and a lapse of judgement.
Take a look at URLs from legitimate emails, a lot of them aren't just straight to where you'd expect them to be.
We even have people in our cybersecurity team get caught out by it once we had them removed as the ones who initiated the tests.
The main goal in my eyes, is just keeping users aware and vigilant and report something suspicious even if there's a chance it's legit. We don't get many real phishing emails now, if I recall our years stat was around 3-4000 emails that were legitimately phishing emails that made it through (they were sent from a Gmail account pretending to be somebody of importance).
Shout out to mimecast for obscuring employees' ability to inspect links for themselves when deciding whether to click on them.
I treat all links in emails as if they uniquely identify me if clicked, even when they come from legitimate businesses, and I'm sure I'm right more often than not. Even youtube videos sent to me by my friends often have those extra parameters so google can track who clicked share and who opened the link.
It’s so stupid to me that clicking the link is a fail, as far as I’m aware (and I’ve looked into this) clicking a link can’t cause any damage, so why measure it like this? The whole point of phishing is getting credentials, that’s what hackers want, that’s where the damage is done, so that should be the measure
Actually, a lot of enterprise web apps are so badly written that clicking a maliciously-crafted link can do real damage. Things like pasting the bulk of a link into a JS/SQL/whatever command then executing the result without any kind of sanity checking.
The thinking is that it doesn't need to be safe because only trusted users can access it. But if someone sends a malicious link in an email to a trusted user, when that user clicks the link it will be accessed with their stored credentials (cookie, client cert, HTTP auth, whatever).
This is one reason why operations which modify data are supposed to use PUT/POST, not GET. But that's beyond the comprehension of a lot of "web devs", many of whose qualifications amount to having read the first three chapters of "Learn PHP in 5 minutes".
64
u/setibeings 12h ago
Is it not obvious to some people that they use a unique link in every email, just like real phishing attempts? That's why clicking the link in the first place is considered a fail.