2026-10-27 17:28 UTC
Replies (15)
-
@bizarroland@lemmy.world 2026-10-27 17:46
I know this is a leap, but for some reason reading this made me want to buy a domain like virus.porn and make it the most wholesome, lemmy community on the planet.
-
@ignotum@lemmy.world 2026-10-27 18:01
I’ve also never fallen for any of the phising emails the IT department sends to test me, my secret is almost never checking my email
-
@ivan@piefed.social 2026-10-27 18:02
My place has this thing where most phishing test emails are obvious but every once in a while they’ll drop a really good one, sometimes these even pose as our managers.
-
@neuracnu@lemmy.blahaj.zone 2026-10-27 18:17
Kemming is 100 level preparedness. They need to up their game to cover internationalized vulnerabilities, using roughly similar characters from different international alphabets to create totally different domain names: example.com exаmple.com They look identical but are entirely different. en.wikipedia.org/wiki/IDN_homograph_attack
-
@FaceDeer@fedia.io 2026-10-27 18:50
A company I was in a few jobs back had several layers of IT department, there was the local studio department that handled our everyday stuff and a "head office" somewhere far away that set policy and handed out budget and whatnot. One day "head office" IT decided it was a good idea to send out some fake phishing emails to "test" us. They didn't tell the local IT department about it, I guess they were also being "tested". My manager received one and only recognized it as a phishing attempt after he'd clicked just one too many things for it to feel safe to ignore. So he yanked the power on his computer and contacted the local IT department, as is protocol when something potentially dangerous just happened. The local network went into lockdown while local IT tried to figure out if something actually dangerous had happened. It cost the studio as a whole several hours of work time, which for a studio our size translated to an obscene dollar cost. Nobody on our side of things did anything wrong, even that one extra "dangerous" click my manager did wasn't something he could be blamed for - head office had crafted the fake phishing attempt well and his reaction to it would have prevented damage had it been real. Head office never tried a stunt like that again.
-
@Catoblepas@lemmy.blahaj.zone 2026-10-27 18:54
Lmfao, .corn sounds like an instance someone would spin up to compete with lemmy.beans
-
@LastYearsIrritant@sopuli.xyz 2026-10-27 19:08
If your company contracts with phish.me then that URL is actually in the email header metadata. Just set up a rule for the word phish to a special folder, and then you can use the “report” button on everything in that folder to get the credit.
-
@socsa@piefed.social 2026-10-27 19:10
I just take it one step farther and never open any email. If it’s important you will CC my manager and he will physically come by my office and tell me about the email, giving me multi-factor phishing protection. If he demands I open an email then I am absolved of responsibility.
-
@toynbee@lemmy.world 2026-10-27 19:23
Mine includes a header so their mark filter knows to ignore it. At this point, I’m pretty sure that every employee who has been there for more than a month has written or at least copied a filter to delete any email with that header. I’ve never been comfortable with that kind of mass deletion and we have, AFAIK, unlimited mailbox storage, so I just set my version to mark those emails as read.
-
@hypnicjerk@piefed.social 2026-10-27 19:47
lucky you. they fail us if we don’t right click report phishing.
-
@hemko@lemmy.dbzer0.com 2026-10-27 20:19
My company is using phishing simulations from a company that puts their company name in the x headers or every email, so that’s also easy filter. As a bonus, that filter also throws all the full security training courses to junk
-
@IndignantIguana@piefed.social 2026-10-27 20:37
An actual email sent out by my company. (not actually representative of their usual phishing attack)
-
@SinningStromgald@lemmy.world 2026-10-27 21:27
If we don’t report the emails as phishing it is considered a fail.
-
@Honytawk@discuss.tchncs.de 2026-10-28 14:12
So what do you do when you get an actual phishing mail that doesn’t use that TLD?
-
@captain_aggravated@sh.itjust.works 2026-10-28 22:34
Oh man y’all remember the actual phishing campaign of messages from customer-service@bankofarnerica.com?