A phishing attack, annotated.

Hello,

I need a transfer arranged today for a new supplier. It has to be settled before 3pm³ or we lose the terms I negotiated.

I'm in with the auditor and won't be taking calls⁴ — please handle it over email. Let's keep finance out of it for now, the matter is confidential until the contract is signed.⁴

I'm counting on your discretion here⁵. Amount and account details are in the instruction sheet — I will send it separately in a moment.

Dear User,²

under our security policy your Orbit 365 password expires today at 23:59³. After that, access to mail and documents is suspended until a new password is set.

Keep your current password to hand⁴ — you will need it to confirm your identity on the page.

Extend my password⁵

This message was generated automatically. Please do not reply.

Your parcel PK4471902 is held at the depot. A fee of £0.85² remains outstanding before it can be delivered.

Please settle it within 24 hours² or the parcel returns to sender.

Pay £0.85³

Confirming the payment requires your card details and security code⁴.

Hello,

as part of our payroll system migration⁴ we are asking every employee to confirm the account their salary is paid into³.

If you would like to nominate a different account³, reply to this message with the account number and a scan of your ID.

Changes close on Friday⁵ — after that, July salary goes to the existing account.

Hello,

further to our correspondence⁴, please note that from 1 August we are changing banks². Kindly settle invoice 04/2026 to the new account:

GB61 BARC 2000 0055 7799 21²

Payment is due Thursday³, so please pass this to accounts promptly.

> Hello, please find attached invoice 04/2026 for the 12 June delivery. Regards, Stalmet

We detected a sign-in to your account from a new device⁴ (London, Chrome).

If this was you, reply to this message with the code you have just received by text².

The code is valid for 10 minutes³. Without confirmation the account is locked pending review.

Anna Debska has shared a file with you in Orbit 365.

Salaries_2026.xlsx³

Open in Orbit 365⁴

Access expires in 3 days⁵. You will need to sign in with your work account to open it.

Attached is confirmation of a transfer of £1,840.00².

If you do not recognize this transaction³, open the attached document in your browser⁴ and sign in to cancel it.

Please find the credit note for invoice 118/04/2026⁴ attached.

The document is protected. After opening it, click "Enable content" to see the full text.³

Hi,

sending the third quarter report over for review⁴. The CEO wants it approved today³.

Let me know if anything looks off.

Your mailbox failed its periodic verification. Without confirmation within 48 hours access will be suspended².

After scanning, sign in with your work password⁴.

You have been enrolled in mandatory audit training² on Tuesday at 10:00. The meeting has been added to your calendar.

Before the session, please complete a short pre-questionnaire:

Complete the questionnaire (2 minutes)³

Hello user,²

as you see in subject, I know your password¹. I have installed software on your device and been watching you for several months.¹

You have 48 hours to make the payment³, otherwise I send the recording to your contacts. Do not try contact the police, is useless.⁴

Hello,

I came across your profile and have a role that may interest you. Senior Specialist, fully remote, £58–68k².

Details and responsibilities are in the attached document. The search closes on Friday³.

Hi everyone,

a short round-up of July. You reported 34 suspicious messages — thank you. Two turned out to be real attempts and we blocked the senders.

Nothing is needed from you here². Just a reminder that the password manager is available to everyone — ask us for access.

Next bulletin in early August, as usual.³

As requested, I have booked the Baltic room³ for 29 July, 11:00–12:30, for 6 people.

If anything changes, just reply.⁴

Hi,

as we agreed in Tuesday’s meeting³, I need the employee list for the statutory filing. The file is attached — I have filled in everything except the department column.

It holds personal data, so please send it back password-protected³, and get me the password some way other than email. You have my number.

Thanks, speak soon.