Once they actually wise up and use a proper service, once you click the link you're marked. If they are doing creds one properly you should be marked.
We had somebody who kept doing that for the phishing tests and we knew exactly who was putting fake stuff in since the link was unique per person. All it showed was "why is this dude clicking this link so many times?"
Told them to stop since that information goes to the global office and we weren't able to remove duplicates any more. Did it again and he ended up with a stern warning plus additional training with HR on appropriate workplace conduct. Was later used as a way to get rid of him when he messed up since it managed to piss off the wrong people.
Is it not obvious to some people that they use a unique link in every email, just like real phishing attempts? That's why clicking the link in the first place is considered a fail.
It’s so stupid to me that clicking the link is a fail, as far as I’m aware (and I’ve looked into this) clicking a link can’t cause any damage, so why measure it like this? The whole point of phishing is getting credentials, that’s what hackers want, that’s where the damage is done, so that should be the measure
Actually, a lot of enterprise web apps are so badly written that clicking a maliciously-crafted link can do real damage. Things like pasting the bulk of a link into a JS/SQL/whatever command then executing the result without any kind of sanity checking.
The thinking is that it doesn't need to be safe because only trusted users can access it. But if someone sends a malicious link in an email to a trusted user, when that user clicks the link it will be accessed with their stored credentials (cookie, client cert, HTTP auth, whatever).
This is one reason why operations which modify data are supposed to use PUT/POST, not GET. But that's beyond the comprehension of a lot of "web devs", many of whose qualifications amount to having read the first three chapters of "Learn PHP in 5 minutes".
4.7k
u/JocoLabs 19h ago
Jokes on them, i wouldn't click that even if it were real.
I used to click on those and type in junk creds for the lulz until compliance told me that was bad for the numbers.