GoDaddy sent its employees a fake bonus email, claiming to offer them a Christmas bonus to help them financially through the COVID-19. However, the email was nothing more than a “phishing test.” This move by GoDaddy has angered its employees and other companies. The Internet apologized on December 24 for the security it conducted to determine its staff’s response to a phishing campaign.
A GoDaddy spokesperson told AFP : "GoDaddy takes the security of our platform very seriously. We understand that some employees were upset by the phishing attempt and we apologize. While the test mimics real phishing attempts, we must do our best to raise awareness among our employees."
This approach was criticized by some in the cybersecurity, due to the “bait” used in the phishing test, but also because of the period the company chose to do so. On the other hand, the company chose this test because it “mimics” a real attack that could happen at any time, given that hackers are exploiting the pandemic and targeting unsuspecting victims.
The test was conducted this month, and the email sent out tricked about 500 employees who clicked on it. The email claimed that GoDaddy was offering a $650 Christmas bonus and asked them to fill out a form with their personal information. Specifically, the fake bonus email read: “While we can’t celebrate together during our annual holiday party, we want to show our appreciation by sharing a one-time bonus of $650! To make sure you receive your one-time bonus in time for the holidays, select your location and fill out the form by Friday, December 18.”
Two days later, employees were notified via email about the ongoing security test, with the company's chief security officer, Demetrius Comes, writing: "You received this email because you failed the recent phishing test. You will need to retake social engineering for security."
