As many ways as there are to crack a company’s defenses, phishing remains one of the most effective ways to launch an attack.

A well crafted phishing email can be a disaster for a company and unfortunately, cybercriminals are only getting more convincing in their efforts to breach defenses. To showcase just how convincing phishing emails can be, Kaspersky observed phishing simulator data from its Kaspersky Security Awareness Platform.

The platform allows an administrator to craft mock phishing emails that mimic what one might encounter in the wild. The platform can help companies understand how much cybersecurity awareness training is needed.

Upon observing data from the platform Kaspersky has found five email subject lines that get employees to open the email and click.

Those subject lines are:

• Failed delivery attempt – Unfortunately, our courier was unable to deliver your item. Sender: Mail delivery service. Click conversion: 18.5%
• Emails not delivered due to overloaded mail servers. Sender: The Google support team. Click conversion: 18%
• Online employee survey: What would you improve about working at the company. Sender: HR Department. Click conversion: 18%
• Reminder: New company-wide dress code. Sender: Human Resources. Click conversion: 17.5%
• Attention all employees: new building evacuation plan. Sender: Safety Department. Click conversion: 16%

Curiously, Kaspersky found that emails which offer instant benefits were less successful. A simulated phishing template offering free Netflix and $1 000 were clicked by as few as one percent of users.

What this tells us is that cybercriminals are preying on the anxiety some employees may have about work and that hits the mark. Truth be told, coming out of a pandemic and an ongoing recession, the fear of losing your job is one many have and likely inspires folks to click links they may not have.

Understanding employees and public discourse is incredibly important to cybsecurity as head of security awareness business development at Kaspersky, Elena Molchanova explains.

“Phishing simulation is one of the simplest ways to track employees’ cyber-resilience and evaluate the efficiency of their cybersecurity training. However, there are significant aspects that must be considered when conducting this assessment to make it really impactful,” says Molchanova.

“Since the methods used by cybercriminals are constantly changing, the simulation has to reflect up-to-date social engineering trends, alongside common cybercrime scenarios. It is crucial that simulated attacks are carried out regularly and supplemented with appropriate training – so users will develop a strong vigilance skill that will allow them to avoid falling for targeted attacks or so-called spear phishing,” she concludes.

[Image – CC 0 Pixabay]