Phishmake

Phishing simulations for teams. Realistic templates.
Measure who clicks. Train the human layer.

[Phishmake @Phishmake]

Has a fake meeting ever almost got you? Yes or no.

[Phishmake @Phishmake]

Attackers like calendars because the notification looks like work, not like a scam.

[Phishmake @Phishmake]

Before accepting a surprise invite:

Do you know the organizer’s real address?
Was this planned in chat or email already?
Does it send you to a second “join” page outside your normal tool?
Unexpected meeting + login page = report.

[Phishmake @Phishmake]

A calendar invite can be phishing. People accept first and think later because declining feels rude.

[Phishmake @Phishmake]

“Your mailbox is full.” “Payroll is on hold.” “Your ticket will close.” These are job-shaped emails. That’s why they beat technical staff too.

[Phishmake @Phishmake]

If a vendor email asks you to log in, go in the way you always do — app, bookmark, official site — not the email’s button. Then see if the request exists.

[Phishmake @Phishmake]

A lot of phishing pretends to be a tool you already use: payroll, HR, shipping, Microsoft 365, a ticket system. Familiarity is the bait.

[Phishmake @Phishmake]

What’s the most believable fake vendor email in your industry? Name the type, not a how-to.

[Phishmake @Phishmake]

Which lure would fool you more today?

[Phishmake @Phishmake]

QR phishing works because people trust their camera more than a URL. The destination is still a website. Treat it like a link.

[Phishmake @Phishmake]

Staff rules:
Don’t enable macros because an invoice asked you to
Don’t scan a QR from a random email just to “view the document”
Don’t open a shared file from a stranger because the logo looks familiar
Get the file from the system you already use.

[LVMPD @LVMPD]

SCAM ALERT: Vishing, Phishing, Smishing, and Impersonation Tactics Scams

Scammers are impersonating police officers, deputies, and federal agents using spoofed caller IDs, emails, and texts. They may use real names, badge numbers, and legal terminology to create fear and urgency.

🔴 Real law enforcement will NEVER:

• Demand immediate payment to avoid arrest or clear a warrant
• Request gift cards, crypto, MoneyGram, Western Union, Zelle, Venmo, or mailed cash
• Ask for SSNs, banking credentials, or other sensitive information through unsolicited calls or texts
• Refuse to let you hang up and independently verify

📞 Vishing: Fake calls and spoofed official numbers demanding payment.

📧 Phishing: Fake electronic notices with malicious links or attachments designed to steal credentials or compromise devices.

📱 Smishing: Fraudulent texts impersonating officials or legal entities. Messages may come from local or unknown numbers to appear legitimate.

🛑 Targeted?

1. Hang up immediately. Don’t engage, argue, or any press buttons.
2. Independently look up the agency’s official published phone number and call it directly. Never use the callback number provided by the scammer.
3. Don’t click unknown links or open suspicious attachments. Delete unsolicited legal texts or notices.
4. Report the scam to local law enforcement and the FBI’s Internet Crime Complaint Center (IC3) at https://t.co/tNSeqsHWJ9.

When in doubt, stop, verify independently, and don’t pay. Real law enforcement does not demand immediate payment by phone to avoid arrest.

[Oge_chee @Ogechee_]

Types of Phishing
- Deceptive Phishing: Fake emails from trusted sources.
- Spear Phishing: Targeted, personalised attacks.
- Whaling: Phishing targeting executives.
- Smishing: Phishing via SMS.
- Vishing: Phishing via phone calls.

[Phishmake @Phishmake]

@sailingbikeruk security awareness training is a must.

Cannot just rely on MFA, 2FA & e-mail filters..
Phishing attacks are hyper personalised, one must be aware about whether the e-mail that just popped up in their inbox, is fake or real.

[Phishmake @Phishmake]

@K4L1_FS that's what great about security awareness, you get the idea whether you are on the edge of getting spoofed or are spoofed just by that one click you made.

[Phishmake @Phishmake]

Not every phish is a blue link. Sometimes it’s a PDF, a QR code, a “secure portal” button, or a voicemail-style email. Train more than one shape.

[Ahmedkhan @Ahmed___khaan]

Phishing attacks are getting smarter, but the right tools can help you detect, analyze, and respond to suspicious emails, links, and domains.

Email Security
• Apache SpamAssassin → Detects spam & suspicious emails.
• MailCleaner → Filters spam and phishing emails.
• Rspamd → Fast email spam/phishing detection.
• OpenDMARC → Validates email sender authenticity.

URL & Phishing Analysis
• URLscan .io → Analyzes websites and URLs.
• ThePhish → Helps investigate phishing incidents.
• GoPhish → Phishing-awareness simulation platform.
• PhishTool → Analyzes and investigates phishing emails.

Threat Intelligence
• PhishTank → Community database of known phishing URLs.
• MISP → Shares and manages threat intelligence.
• PhishStats → Tracks phishing campaigns and statistics.
• OpenPhish → Provides phishing URL intelligence.
• VirusTotal → Checks files, URLs and domains for threats.
• https://t.co/YNfRmq9AAn → Uses automated analysis to detect phishing.

Supporting Tool
• Oletools → Analyzes suspicious Microsoft Office documents and macros.

Remember: Verify before you click.

[Phishmake @Phishmake]

@FischerKing64 absolutely @FischerKing64

[Phishmake @Phishmake]

@MonsteraKenzo @BitBoxSwiss some links are malicious and so, be careful when any such malicious mail pops up into your inbox.

[Phishmake @Phishmake]

@DonalDevine @BitBoxSwiss always double verify, and never click on such links on the sms. they're mostly phishing messages.