Staying Safe Online During the COVID-19 Pandemic

Testers hid phishing codes in fortune cookies promising a $50 gift card, luring staff to a promo site that proxied the corporate login via Evilginx — physical media sidesteps email training.

Details a bypass of Mimecast URL Protection and file inspection found during a social engineering pentest, responsibly disclosed to Mimecast, underscoring why layered defenses remain essential.

Warns of social engineering as employees return to offices—fake return-to-office emails, help-desk MFA enrollment tricks—citing Verizon DBIR's finding that 85% of breaches involve a human element.

Covers the security side of mass remote work: phishing-aware user training, hardened workstation baseline images, patch tracking, and the host-based attack surface that grows as employees go mobile.

Explains why end-to-end encryption in apps like WhatsApp isn't overall security: encrypted channels still deliver phishing links and malware, and endpoint and application risks remain fully in play.

A practical guide to spotting phishing — email, spear phishing, smishing, vishing and whaling — with example messages, red flags such as urgency and unsolicited data requests, and defence strategies.