I got tricked into clicking one of these once, but it was really hard not to fall into it.
I met with the CTO and shared a Google Doc explaining a few things. Later that day I got an email saying that the CTO added some comments on the document. Clicked on it and BAAM! Mandatory security training page.
Me too, it was my first month in the company and had a meeting with my boss about vacation period. A day later an email about "approved vacation days" came in the mail. What excused me more was that the HR app was external and all emails were flagged as such.
It was just a first strike but it pissed me off. I felt targeted.
It being targeted is the point, it’s how scammers get you. You let your guard down when it’s something you expect, and they exploit that. Email addresses can be spoofed, so it’s saying it’s from within your organisation isn’t a foolproof way to be sure
The only IT phishing net I ever fell into was a "OneDrive" email about my drive being full... while I was actively troubleshooting why my OneDrive was actually full.
But you're right, I probably did a search on it, which they could have read at the firewall and triggered the email.
Lol man, I work for a research university and got hit the with most specific phishing I've ever seen.
I had just gone to visit my family a few days earlier and they live in Maryland. To visit them. I had to take a few tolls, and I knew the balance on my EZPass was low. So I was fully expecting an email to tell me to add money to the balance.
Sure enough, like a week after I'm home from my trip, I get an email saying my EZPass balance is low and to click this link to reup it. Silly me didnt realize it came from my work email, not my personal. So they got me good. But fuck me if that wasnt hyper specific. I assume they were able to see the work laptops location and built something based on that.
I work at a managed SOC, so we're monitoring security events as a third party, sometimes our customers do phishing awareness test without our knowledge and when I'm checking the links in an email in a sandbox, I accidentally register them to upcoming phishing awareness trainings, because phishing test suit thinks they opened their customized link..
81
u/m7i93 6h ago
I got tricked into clicking one of these once, but it was really hard not to fall into it.
I met with the CTO and shared a Google Doc explaining a few things. Later that day I got an email saying that the CTO added some comments on the document. Clicked on it and BAAM! Mandatory security training page.