OK, this is weird...

[Dreamstalker]

I think I posted before about how I got an onboarding email (typically the very last step in the hiring process) from ExJob from a store not even in my country, asking me to set up an account on an HR platform the company does not use and directing me to contact "your local HR" (but no indication how to actually contact them) when the link expired after five days.

So far I've gotten three such emails total. First one was from the other store, the next two were from a generic HR address that doesn't exist; all addresses are no-reply. Not only that, but the second and third emails have an error "If you do not click this link within days of expiration" (first email specified 5 days, the rest do not)...all the emails came exactly five days apart. The links themselves look legit, I'm not clicking on anything.

[Ironclad Alibi]

It does look like a phishing attack.

[Bandit]

Sounds like the NewJob's HR system has been compromised, and as I.A. said, they are using the data as a phish.

Careful on what you click....

B

[Dreamstalker]

My first thought was that ExJob did get compromised...kinda serves them right, I did warn them about assorted vulnerabilities a year ago and was ignored because I wasn't an official part of IT.

[Ironclad Alibi]

Quoth Dreamstalker

My first thought was that ExJob did get compromised...kinda serves them right, I did warn them about assorted vulnerabilities a year ago and was ignored because I wasn't an official part of IT.

That sounds like a movie trope.

"Never believe the guy without credentials."

I don't think it is confined to the movies. It happens all too often in real life.

[Dreamstalker]

ExJob's IT department wasn't all that bright, the few interactions I had with them. Too by-the-book when the majority of actual glitches were of the "That isn't supposed to happen" variety. They seemed too used to working with relatively closed systems up in the company office and not the chaos of a stockroom/salesfloor where anything could cause anything (and often did).

[Dreamstalker]

Got another such email on 10/1; so far that makes 4, all exactly five days apart. The link is exactly the same in each one and looks like a legit [program] link...but that's in an email program so who knows. If it was a legit onboarding thing I would have been contacted elsewise.

Sadly my "forensics" laptop (I don't use it other than trying to break software so NBD if it gets infected) is having issues so I can't delve into it just yet. Maybe I can use this as a test case in the security course I'm taking...

[EricKei]

You just reminded me of a Windows Security seminar I attended oh . . . two decades ago. They talked about – well, guess I remember only two things of note from it, and they're things that I HOPE have been rectified since then, but ya never know:

1 - Windows' login screen has (had) all of the integrity of a sieve, and

2 - Failed attempts to login to a system (with a bad password) are/were NOT logged under critical events (or whatever the category they use for "OMFG you need to know this right EFFing now!!" stuff), for some inexplicable reason; they were tracked elsewhere, but you had to know where to look. As such, you could just keep spamming the login screen unless there was a Policy that somehow prevented you from doing so.

[RealUnimportant]

Quoth EricKei

1 - Windows' login screen has (had) all of the integrity of a sieve, ...

Yeah, I remember when you could occasionally leave the password field blank (and even set your password as blank!) and gain access, or just cancel the password dialogue and get guest access to the machine by default. Heady days.

[EricKei]

To the best of my knowledge, prior to w2000, ALL users were effectively Admins, even if they were categorized as Guests within Windows. 98/SE did this, not sure about wMe. The seminar happened as XP was getting a decent foothold on the market.