In early September, a phishing attack surfaced that imitates a security awareness training email notification. The phishing email comes from cybercriminals behind this attacks and claims that your training assignment will expire within 24 hours. You are directed to click a link to complete your training.
The link in the email shows the name of your training platform, but if you hover over this link with your mouse, you'll see that the destination domain is actually “msk.turbolider.ru”. Clicking on this disguised phishing link takes you to a phony Microsoft Outlook login page. If you enter information on this page, it will be sent directly to the bad guys.
How do you tell if an email came from a reputable source? Follow these tips:
- Remember that any site, brand, or service can be spoofed. Always think before you click, especially if you were not expecting the email.
- Before you click, always hover over a link to preview the destination—even if you think the email is legitimate. Pay close attention to URL misspellings or unusual domain names.
- If you are suspicious of an email that claims to be a training notification, reach out to your manager or training coordinator for help. They can find out if the notification is legitimate.
Stop, Look, and Think. Don't be fooled.
