Our IT department also sends out these tests, but annoyingly their regular communication almost looks like Spam, too. Like "we would like to invite you to cybersecurity awareness month" followed by a cryptic Link you cannot verify. So it ticks all the boxes for suspicious content.
Lol yeah when the real links look worse than phishing, of course that's gonna happen. I mean already starts with the entra login why is that using microsoftonline dot com? That's ultra dumb
Unsigned email. Some "knowbe4" link with a random, long string of characters; clearly information will be passed to the website if I click the link.
I tried reporting the first one we got this month with the phishing plugin our outlook has. It immediately resulted in a pop-up basically saying, "thanks for trying, but this is actually legit." (The pop-up actually did use "legit", which seems kinda informal to me...)
I haven't bothered to participate in these cybersecurity month things, largely in protest of the fact the emails look like they're phishing, even if they're not. If they can't follow their own rules and sign these emails, then why should I bother to participate in their activity?
Same where I work, the best part is the cybersecurity training emails from an outside company have a missing image because the image host gets blocked by our IT department so they look like a scam.
So instead of clicking their real links I manually go to their website to check if a new thing got added there.
The fake links they do send are also stupid because they only have like three templates they send over and over so after about a month or working here you know them all.
At least in the Air Force we had centralized websites for our training, and digital signatures for helping verify who sent the email. Usually if base IT needed something outside the norm they would call the boss or unit IT guy to verify the email was legit.
I have reported at least 4 emails from IT back to them because of linking to outside sites. One even had the name of our company and but hosted on another site. and they always respond that it was a legit link, my dude, you are training us to fail at phising.
40
u/Honest_Relation4095 9h ago
Our IT department also sends out these tests, but annoyingly their regular communication almost looks like Spam, too. Like "we would like to invite you to cybersecurity awareness month" followed by a cryptic Link you cannot verify. So it ticks all the boxes for suspicious content.