Between November 12 and 18, 2025, KAUST Information Security conducted a targeted phishing simulation themed around a “FREE Month of Chat GPT Premium” offer.
The simulated email included a link to accept the offer, encouraging recipients to click it — a classic example of how attackers use what seem to be tempting opportunities to trigger clicks.
While it may have looked convincing, several warning signs revealed it wasn’t legitimate.
These simulations are part of our ongoing effort to help our community recognize evolving phishing tactics and avoid falling for future simulations or real-world attacks.
By staying alert and verifying before clicking, we can better protect ourselves and the organization from cyber threats.
📌 Repeat clickers: If you’ve clicked links in multiple recent simulations, you’ll be automatically assigned a short online refresher training. Please complete it promptly to stay informed and better protected. Repeated clicks may also lead to additional interventions, escalations, or further awareness activities to help reduce risk.
Indicators of phish
Check the different indicators of the Phishing email in the infographic below.
🔎 Think before you click! Report suspicious Emails!
Don’t just delete — Report It!
If you suspect an email might be phishing (whether real or simulated), report it immediately! If you have even the slightest doubt, don’t click—reporting is the safest choice and may help protect others.
🚨 Why it matters
Reporting helps the Information Security team detect and block threats early, protecting not only your account but the entire KAUST community.
Every report strengthens our collective defenses and keeps our digital environment safer for everyone.
👉 How to report phishing
- Outlook: Click the “Report Phishing” icon
- Gmail: Use the envelope with a fishing hook icon.
📧 Other Cyber incidents or breaches → cyberincidents@kaust.edu.sa
💬 For questions or guidance → askinfosec@kaust.edu.sa
INFORMATION SECURITY