IT professionals can't spot phishing simulations

Oh, nice! :D [re: PSA: ShredOS fake malware website]

“Fair enough, I'ddo the same in those cases, or temporarily log in to my password manager or do it from my phone most likely, if I can. If all those fail, I'd flip the type if I'm struggling.”

“Seems like ppl agree that AI-generated phishing is still pretty easy to spot and the examples I see do look clumsy. But the only ones that get shared are the ones that someone caught.... If one was good enough that nobody flagged it we’d never see a screenshot posted to a thread like this. It reminds me of the WWII bomber armor plane story where they wanted to reinforce the spots with the most bullet holes till someone pointed out they only looked at planes that made it back. Am I overthinking t”

Password manager is a better way to go

“This is an HR issue. If you have no policy on consequences for clicking on a bad link no one will care. That has to be addressed first. As for method I send out a reminder every 3 months as to what to look out and what not, but I preface that I would rather have a million "is this spam" emails than one go through.”

“One of the problems I have is that it doesn't cover the worst sorts of targeted scams. When they think that there are easy signs to look for, the worst scams are harder to see I mean, how do you train for someone who's compromised a trusted domain/email, sat there learning the back and forth, then crafts a scam just for you? But considering just how often I've seen people fall for the easy ones, maybe getting trained on that isn't the worst idea. Ifn' you put better protectio”

“And you can filter your emails on the X-PhishTest header to send the automated phishing into a specific folder so they're easy to avoid.”

“I'd probably keep it simple and use GoPhish for the campaign itself, then build a couple of basic landing pages that resemble the kind of flow users are used to without copying Microsoft too closely. I also wouldn't collect real credentials, just track that someone reached the page and attempted to submit something. For awareness training, that's usually enough to show where the risky behavior is.”

“I think you are right. We train twice a year and I send out reminders once or twice a month but they still click these damn things. We’re talking masters and phds in education haha”

“When you say it spread by itself, did people still need to click a phishing link and sign in, or did it spread without them doing anything? Also, which session time length did you change, and how could you tell it helped stop the attack? One point about 2SV: login codes can still be stolen through AiTM phishing, while security keys offer better protection. A short timeline or examples from the logs, with private details removed, would help other admins check for the same attack.”

“This is just an AI posting someone really dumb on using computers. But these people are the majority are the majority of computer users! Most people don't give a shit about anything and just want the messages to go away. At least 1/4 of my users would fall for this.”

This is a pretty well known technique. Nothing new.

“At the end OP says "Check your Mac" "Paste into Terminal" and we are surprised they fell for it???”

“100%, it's literally takeaway #1 in the post. Writing it up so the next person recognises the setup before they paste. It was a real business's site I was researching, it looked exactly like the Cloudflare checks we click through daily, and the only thing that showed in Terminal was "BotGuard: Answer the protector challenge". 15,500 other machines on that wallet fell for the same thing, so it's working on plenty of people who know better”

“> a fake Cloudflare "Performing security verification" page that asks you to press Cmd+Space, open Terminal and paste. It looks like the checks we all click through daily That’s a red flag. Latest macOS warns against pasting into terminal with an adequately scary warning.”

That's correct, and I was wondering about the reasons.

Ah, that's a good comparison, I did not think of that.

“Create your own policies that are the same as preset and monitor / adjust over time. Create a quarantine policy to allow users to request high confidence phish. Carefully add the billing notice to TABL.”

“Wait, are you saying they somehow made it execute something from just cloning it? Or you mean just running it. How'd you realize what was happening before it was too late?”

“yes. wasm doesn't change that.”

“Do you seriously think it was if the security.txt wasn't setup? Does AI have a magic wand that can bypass controls that humans cannot?”

“I'll say kind of gray but better to avoid. I saw a massive email campaign against our domain yesterday. The whole email was invite to an event from one of our contractors compromised account and every link was just to download the screen connect setup with access key, some users do click on it but no install permission and then defender deleted all these files. In a personal machine or if the user had admin privilege attacker would have got the machine registered in his account and full acce”

“And related, some people are completely incapable of describing what they're clicking on. I am the computer guy (and web guy and marketing guy) at a small company, and I regularly gets descriptions like "I click on the thing and it's not doing the thing it's supposed to" no mention of what application they're even trying to do something in, or what they're trying to do. But I've worked with my boss for 19 years now, so I've gotten really good at deciphering”

“Anyone tired of the e-mails sent out by IT regarding Phishing? For example, one was sent out on payday supposedly from Payroll regarding a dispersement. Of course, thinking there was an issue, I clicked on it and got a 'warning'. I get checking for phishing and warning people, but sometimes it's just overboard IMHO. ETA: Holy CRAP guys this is a minor annoyance and this is literally the FIRST TIME I clicked on something in over 20 yrs, so don't need lectured, called an idiot, or”

“Got one of these this morning and it's cleaner than most, so posting in case it's doing the rounds. Subject: "New Login on Your ScreenConnect Instance" From: ™ ScreenConnect ™ <host@screenconnect[.]com[.]tj> Link: cloud.screenconnect[.]com[.]vu/PrivilegeCreep The body is a near-perfect copy of a real ConnectWise security notification: proper logo, footer links to the legit connectwise.com privacy/terms/support pages, and it even lists "Domain: cloud.screenconnect.com”

Good point.

“If it has access to all your info and has YOLO permissions In many companies, random desk guy #4482 has YOLO permission/keys to the kingdom, it'd just never occur to him to manually go in and make some random database query. Now an AI sitting on his console has all of his permissions, and can slam out scripts and applets to do all the things with impunity.”

“Lol I do know when they ran phishing tests on us a lot of the older partners would fail. So I can imagine people would download a lot of dumb stuff. Hopefully there was some system in place”

“I wouldn't worry about restoring backups until you figure out how they got in, you can scrub the whole network clean and restore everything, if you don't plug the hole it's just going to happen again.”

“Five years ago, the company I worked for was hit with a ransomware attack. Six months, $100k, two reinfections and a hell of a lot of disruption to business later, we'd managed to recover to about 90% of what we'd been like pre-attack. And I decided that, after 22 years in IT, I was done with computers. I'm a guitar tech now.”

“We "quit" a client because they refused to allow us to implement even the most basic safeguards like MFA on email. Client had a guy on staff who was a purported expert in IT (he actually knew zero...nada) but client listened to that guy more than they would listen to me. Within a year one of their people had their email account taken over and $ 200k ended up going missing "That guy" quietly retired and slinked away.”

“That's the other thing, best to avoid it. But when it happens, you best have a backup. Network segmentation and proper Controls can greatly reduce damage done, but stuff like that needs planing and isn't something you can retroactively do...”

“I don't have a sarcasm detector, so I don't know if you are being serious or not. My google gmail account alerted me that my account manager passwords were exposed in a data breach, and then got an email saying that a low stakes account was at risk of being hijacked. my account's password was reset before I had a change to reset it myself, so I have lost control of that account, seemingly forever. I don't even know what personal or private info was in that account, so I am not to”

Sure.

“I nearly got phished earlier this year. 24+ years in software engineering, I know exactly how phishing and spam work and what to look out for, and it still almost worked on me. That's what made me question the entire email landscape rather than just my own attention.It seems every attempt to fix it so far requires either a complex process, joining a closed system, or accepting that mail can never be trustworthy. Or maybe we just need something new and open alongside SMTP that meets our modern-da”

“Good starter list, add security awareness training. I know it seems like “that’s common sense stuff” but you’d be surprised.”

I'm talking about malware, as does the comment you replied to.

“It’s almost as if there are a lot of people posting ads pretending they aren’t…”

“If someone is a sysadmin and does ANYTHING involving the run command for a captcha they need to reconsider their career choice. This is the equivalent of falling for "press alt-F4" in Counterstrike.”

“Same here. Some people will click on anything and it can take a company down for days. If the IT department can identify the weaker links and educate them better by doing this stuff, I'm all for it.”

“Can corporate offices relax with these spam fishing simulators I don’t need a heart attack every other week while I’m in the middle of my workload. submitted by /u/Affectionate_Leg2826 [link] [comments]”

“You’re super concerned about NIST compliance, but are willing to download a browser extension that will read and save passwords to a clipboard? Hahahaha this post is a joke.”

“All remote inputs are a threat. Don’t trust anything. Everything must be verified as accurate. Someone could mail some invoices for things never purchased. Would they get paid because USPS is an official mail carrier?”

“Worth noting you had to allowlist the simulation to make it land, which means the mail you are being graded on is the one batch your controls were told not to inspect. That is a measurement artifact, not a skill gap. Real phish get scored by SPF, DKIM, DMARC and the gateway before you ever see them, and the ones that survive all that look different from a sim that walked in through a bypass rule. If the program cares about outcomes it should report how many real messages reached inboxes, not how”

Haha! I was just about to say the same thing 🤣🤣

“Or investigating, that's the only other saving grace I could offer. Never on your own workstation of course. We did a trial of KnowBe4 at my last workplace and sent a phish test to our userbase as part of the trial. The IT director decided only to tell me and the security admin (as we had to set up the Exchange server to send it) as he wanted the IT folks to be part of the test. We were reviewing the readout and the senior server admin pops up like a prairie dog over the cube after the meeti”

“Our phishing simulations come from a specific domain (KnowBe4) so I have a rule in place to flag any sent to me as High Priority with the red exclamation mark -- so I pay special attention to them -- haven't failed once LOL”

“Dad asked me for my social the other day. It was legit. He had started a new job and was filling out life insurance forms. I still wrote it out, took a pic, and sent that. He's a software dev so he grokked why I did it. I'm an info sec engineer, but even if I wasn't, I came of age when you maintained strict anonymity online. OP, you need to work on your critical thinking skills. See if you can get your hands on phishing examples and start looking for similarities. If you've been”

“When in doubt, always report it as phishing. If it’s a test, you’d have passed it. If not a test, they will say so and then you can go about click-clacking all your heart desires.”

“i always ask my coworkers now. did you get this, what do you think it is, I guess if it’s real I’m not getting that healthcare benefit.”

“Our tier1 guys are good. I only get tickets escalated when they legitimately can’t solve and issue, or they know how but don’t have the right PIM role to do it themselves.”

i just report anything even slightly suspicious

“I had my masters thesis in human aspects of cybersecurity. One of the things I have learnt is that gamification only helps a small portion of the population. It's about some personality traits and the composition of the people in the organization. So, I don't like these ineffective methods enforced over the whole population. My solution? Open Message Header Analyzer on Outlook, find the unique header used by the phishing simulation tool, as it is needed to get whitelisted by security pro”

“One good way to start is to start taking an interest in phishing. There should be some resources online about the techniques that are used and the sociology of why why work. There are also some good reports of when phishing worked and the event they sparked off. There are probably some entertaining videos on phishing on youtube for those events. What have you tried in the past? Have you tried removing the one-click link. in emails so it slows you down and you have to paste the link into a browse”

To add to this- don’t be curious. If ever in doubt mark as phishing.

“TBF Outlook making it hard to easily see the sender emails and headers doesn't help this one. I've mostly just stopped checking emails. It's almost all spam or corporate spam. Anything relevant comes up in conversation or slack/teams. Email as a workflow needs to be nuked from orbit. It's the equivalent of throwing a todo hand grenade over a wall and running away. Zero feedback and just an easy way to defer things.”

“Was HR warned that they might get (and did they agree to) a SHITLOAD of work diffusing the situation of pissed off users that got an email full of threatening lies about their income being fucked with, including insanely short deadlines? It's a great test, but you preserve that relationship by bringing them in on it, giving them the opportunity to handle it instead of being blindsided, and let them play a part in giving the users kudos instead of just eating the brunt of it. It's one thi”

“If anyone complains Ive been doing this for years now. If I get an unexpected email from outside the company, I either block it or flag it as phishing. I don't think twice about it. (I also set my phone to not disturb me with txts or calls from numbers not in my contacts. They can leave a message) If it was important, someone I trust will let me know. Hasn't happened yet.”

Bro nah that defeats the entire point 🤣