How average folks don't stand a chance against phishing, example
#80,144,963: "Security" "Professionals"
"Warning! Your account is about to be deactivated."
Log in soon or terrible things will happen.
Consider clicking on a link in this email.
BUTTON [Click it... Click it... Click it...]
Grey on grey because accessibility is for losers.
Click the password manager plugin icon on a browser tab,
start typing "cis...",
click to open and autofill credentials and login (in one step),
click the (old) password field to autofill,
click to accept the suggested very long and random password suggestion which autofills both the new password field and the one to check that the autofill typed it correctly the first time then automatically submit,
log out, and
wait for the next email from Compliance Isn't Security inviting me to the next dance.
For the historians: this is during the current wave of phishing campaigns claiming that your service is being shut down, retired, updated or otherwise changed in a way which requires you to click urgently before all that you love is lost.
PS. "This email was sent with love from"
PPS. NIST SP 800-63B §3.1.1.2
#6 -
https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver
#Phishing #ComplianceVsSecurity #CIS #CenterForInternetSecurity #InfoSec #InformationSecurity #CyberSecurity
