With a slew of holidays approaching starting this weekend, a press release from cybersecurity training firm KnowBe4 caught our eye that is worth sharing.
As part of its global phishing report, analysing phishing over the first three months of the year, KnowBe4 spotted a rather alarming trend.
The firm found that email subject lines that contained mention of a holiday were more likely to be clicked on. This data was collected using in the wild emails which employees who work for KnowBe4 clients reported as suspicious. Simulated tests conducted by KnowBe4 were also included.
The most enticing subject lines according to KnowBe4 are:
- HR: Change in Holiday Schedule
- Someone special sent you a Valentine’s Day ecard!
- Patrick’s Day: Employee Behavior/Company Policies
- Our Valentine’s Day Gift To You
- Starbucks: Happy Holidays! Have a drink on us.
With the exception of the Starbucks email subject, these are rather convincing and we could see even the most alert employee to fall prey to these emails, especially if an internal email address has been compromised.
Looking at the Europe, Middle East and Africa (EMEA) region we see a different trend with email subject lines about HR and IT being more convincing.
Authorize Pending Transaction on your Wallet, HR: Registration for COVID-19 Study, IT: End of Year Password Policy, HR: Code of Conduct and Your Benefit Account Has Been Updated, all proved to be tempting lures for employees in EMEA.
“HR-related messages such as a change in the schedule for the holidays likely piqued interest from employees to see if they would receive an extra day off or shortened work schedule due to the holidays. It is important to remember that cybercriminals utilize various tactics such as preying on people’s emotions when executing their malicious scams,” explains chief executive officer at KnowBe4, Stu Sjouwerman.
Heading into the long weekend, we wary of emails that play on emotions and if you receive a mail that appears to be from HR or IT, it might be a good idea to confirm whether it is legitimate.
[Image – CC 0 Pixabay]
