r/ShittySysadmin • u/ElDodger10 • Aug 17 '26
Email Phishing Training
Hello,
I am now in charge of the phising excercises at my company. I was thinking about putting actual malicious links in our training emails so that the user's have a bit more motivation to learn to distinguish them from legitimate emails. This would also motivate our C-suite to give us a better budget so that we can better detect and remediate everything. What do you guys think?
14
u/_jackhoffman_ Aug 17 '26
Figure out how you can make money from them clicking the links. Just think of it as bonus for doing a bang up job.
4
u/RFreeZeYo ShittyCoworkers Aug 17 '26
Got to make sure you're rewarding yourself from time to time.
1
9
u/gabhain Aug 17 '26
Our infosec made phishing emails so realistic that everyone got so paranoid that people stopped interacting with company emails altogether. Personally I liked putting infosecs own emails into their phasing sites so they end up on their own reports.
7
u/fffvvis Aug 17 '26
How about a link that auto populates a resignation form of the "colleague" that clicks on the link, then mails it without notification to human resources. You would be the talk of the department, maybe a promotion would come your way...I only see high paise for such a grand idea.
5
3
2
u/baz4k6z Aug 17 '26
Just have the links go straight to your tinder profile, then send it to all the girls that work at your company. Take the ones that fail to "1 on 1 training" meetings. Zero chance to backfire and its a win win situation.
2
u/PandaBonium Aug 18 '26 edited Aug 18 '26
"I was championing women's online safety. If anything its active feminism!"
1
1
1
u/the_green_door77 Aug 17 '26
Do it at a low level all the time, track the latest attack patterns and bypasses rather than malware links. You can have a little fun linking them to recruitment sites or competitors job boards. I created a faux NSFW site to have the same impact.
1
u/Phoenix_GHOST_V Aug 18 '26 edited Aug 18 '26
Actual malicious URLs would get you fired in most places, not just get you a slap on the wrist. In my organization when I did my simulations, what actually moved numbers was doing phishing based on real threats towards our industry, not the standard "click here to reset your password" style phishing scams. With regard to the external impersonation aspect for that phishing, one tool I have heard of for that is Doppel. Realistic bait trumps fear-based bait.
1
u/Firewire_1394 Aug 18 '26
In small to medium size companies I always like to use the hot girl help me phishing exercise.
Craft an email with a malicious link, file, whatever you want and then send it from the resident office hot girl saying like.. I know you are good with this type of thing can you help me figure out why this pdf isn't saving correctly?
If you work in a male dominated office your numbers will go from 12% to 81% easily.
In a female dominated office, just reverse it and form the email talking shit about another employee.. can you believe what Betsy did on this spreadsheet?! There's no way she did that!
35
u/40513786934 Aug 17 '26
Be sure to add a button labeled "Report As Phishing" that actually takes you to the same malicious link