• bigbangdangler@reddthat.com
    link
    fedilink
    arrow-up
    10
    ·
    17 hours ago

    Given how polarized parts of the world currently are about some specific issues, I would not at all be surprised if this became a real thing.

  • this@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    5
    ·
    16 hours ago

    Normally I would think of phishing as something that only the scum of the earth would do, but whoever wrote this is cool in my book.

  • Somewhiteguy@reddthat.com
    link
    fedilink
    arrow-up
    238
    arrow-down
    1
    ·
    1 day ago

    Oh man. This is brilliant for phishing training. Get through some armor. Don’t let your biases get in the way. You can do a variation around this theme. One could be similar to above. Another is one that says you can opt-into this kind of thing by “Managing Preferences”. You’ll hit a large swath of people without them paying too much attention. I like this.

      • restingOface@quokk.auOP
        link
        fedilink
        English
        arrow-up
        74
        ·
        1 day ago

        Reminds me of the COVID relief payment simulated phishing emails that made headlines. People complained that they had to take additional training after clicking some “Click here to retrieve your COVID relief funds” link during the early days of the pandemic that turned out to actually just be their corporate IT team sending a simulated phishing attack. They expected that this was the official government relief page that they have been waiting for, and were excited for the financial relief. Many people claimed that it was not okay do “prey” on people’s desperation at this point, but these simulated phishing emails were just getting people wary of the real thing. Actual scammers who were actually attempting to steal your money were absolutely sending these types of COVID relief phishing emails for real. So, these simulated emails were just preparing users in case one if the real spam emails happened to slip through the filters.

        • Somewhiteguy@reddthat.com
          link
          fedilink
          arrow-up
          24
          ·
          1 day ago

          People get mad when they feel like they weren’t ready for training, but to your point, that’s why we train. To make you more aware when the real thing comes. Check all of your links. Verify it’s real before just clicking through.

          The issue has come from some companies threatening jobs when people don’t perform properly. I would love it if people saw this as just training and not a personal attack. You fell for the trick now how do you not get tricked next time? It might help if we did a quarterly report and put it on the intranet for people to see how many got clicked. Don’t make it a Wall-of-Shame, but a report to see how good things have been going. Put out sample emails that were the trickiest and what were the tells. Make Security a thing that is a growth aspect, not a shaming tactic.

          • ButteryMonkey@piefed.social
            link
            fedilink
            English
            arrow-up
            3
            ·
            20 hours ago

            My last job posted the failure rate for every single phishing simulation, and nobody ever felt called out as a result.

            We had between 1-10% fail any given test, but our ceo got phished successfully by an actual scam, and that had ripple effects because his account was compromised and sent out further phishing. So we all sort of knew that even those at the top fall for it, which made people who failed feel better.

          • drcobaltjedi@programming.dev
            link
            fedilink
            arrow-up
            6
            ·
            1 day ago

            Yeah, at my last job we had fake phishing emails and if you clicked the link on them then the IT manager would see your name lit up on a dashboard. They were sent out randomly like a regular phishing email. The point is it’s a pop quiz.

        • SparroHawc@piefed.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          edit-2
          23 hours ago

          The thing that annoys me is that I still need to be careful when clicking on links in emails to my work address, despite having my web browser locked down to the nines. I just wanted to see what the page looked like, security peeps! I’m not a risk! I knew what it was!

          Still had to go through additional training, mutter grumble…

    • HeHoXa@lemmy.zip
      link
      fedilink
      arrow-up
      1
      ·
      17 hours ago

      That was my first reaction too, but then I thought there are probably positions in any large company where rigid standard grey soulless professional emails are an absolute requirement and would need to disable any flair.

      Not that this probably changes things for the phisher. It’s not exactly a surgical practice to begin with, and this approach definitely shifts the average.

    • 4am@lemmy.zip
      link
      fedilink
      arrow-up
      19
      ·
      1 day ago

      This is actually a phishing training, now your company ragebaits you to teach you about the dangers of rage baiting

    • artifex@piefed.social
      link
      fedilink
      English
      arrow-up
      4
      ·
      21 hours ago

      I’m just another internet rando, but I did get this exact email on my work account maybe 2 weeks ago. I thought it was so clever I didn’t even forward it to our cybersecurity team.

  • atopi@piefed.blahaj.zone
    link
    fedilink
    English
    arrow-up
    5
    ·
    1 day ago

    the port87 mail client actually has a trans theme

    you can activate it by typing traaaaaaaa in the theme search thing