Cyber Directorate’s Phishing Exercise Draws Clicks From 24% of Tested Employees

About 24% of employees tested in a National Cyber Directorate phishing exercise clicked its simulated malicious link, according to results reported on Sunday. Approximately 29,000 emails and text messages were sent to workers at 49 organizations. The findings concern those tested employees, rather than a survey of the Israeli population. The message impersonated an employer’s human resources department and threatened to suspend a meal subsidy at 14:00 unless recipients updated payment information. The link used an unofficial address. Employees who clicked reached a Directorate page explaining that the message was a simulation and offering guidance on recognizing impersonation attempts. The disclosure accompanied National Cyber Protection Week, which opened Sunday and runs through November 12. In a separate public campaign, the Directorate staged displays reading HACKED on digital screens in Tel Aviv. Explaining the screens in its own announcement, the Directorate said, “It was us.” It stated that the display was a simulation rather than an actual cyberattack. The Directorate had announced its free national cyber-protection portal on November 4. Its tools include Click Check, which checks suspicious links, and Identify the Impostor, an interactive phishing-identification game. The portal also provides protection checks and organizational tools, alongside the campaign’s public awareness activities.