Cảnh báo: Doanh nghiệp bị giả mạo email, và cách HimiTek dùng Automation để xử lý

Warning: Businesses Are Being Impersonated by Email — and How HimiTek Uses Automation to Stop It

Có một kiểu sự cố khiến nhiều chủ doanh nghiệp SME mất tiền rất nhanh nhưng lại thường bắt đầu từ một thứ nhìn cực kỳ bình thường: một email...

There is one type of incident that drains SME cash frighteningly fast, yet often starts with something that looks completely normal: an email that looks exactly like an internal message,...

def score_email(sender_domain, trusted_domains, subject, body, has_attachment, has_link, display_name):
    score = 0

    if sender_domain not in trusted_domains:
        score += 30

    risky_keywords = ["doi tai khoan", "chuyen khoan", "gap", "invoice", "payment", "xac minh", "dang nhap"]
    content = (subject + " " + body).lower()
    for kw in risky_keywords:
        if kw in content:
            score += 10

    suspicious_names = ["ceo", "giam doc", "ke toan truong", "supplier", "nha cung cap"]
    for name in suspicious_names:
        if name in display_name.lower():
            score += 10

    if has_attachment:
        score += 15
    if has_link:
        score += 15

    if score >= 60:
        return "high", score
    elif score >= 30:
        return "medium", score
    return "low", score

const emailRisk = "high";
const containsPaymentRequest = true;

if (emailRisk === "high") {
  console.log("Gắn cảnh báo đỏ trong giao diện email");
}

if (emailRisk === "high" && containsPaymentRequest) {
  console.log("Kích hoạt quy trình xác minh 2 lớp");
  console.log("Tạo biểu mẫu xác nhận nội bộ trước khi duyệt chuyển khoản");
  console.log("Thông báo cho kế toán trưởng và IT");
}

#!/bin/bash
INCIDENT_ID=$(date +%s)
echo "[${INCIDENT_ID}] Suspicious email detected" >> security_incidents.log
echo "Create ticket for IT review"
echo "Send summary to operations manager and leadership team"

def score_email(sender_domain, trusted_domains, subject, body, has_attachment, has_link, display_name):
    score = 0

    if sender_domain not in trusted_domains:
        score += 30

    risky_keywords = ["doi tai khoan", "chuyen khoan", "gap", "invoice", "payment", "xac minh", "dang nhap"]
    content = (subject + " " + body).lower()
    for kw in risky_keywords:
        if kw in content:
            score += 10

    suspicious_names = ["ceo", "giam doc", "ke toan truong", "supplier", "nha cung cap"]
    for name in suspicious_names:
        if name in display_name.lower():
            score += 10

    if has_attachment:
        score += 15
    if has_link:
        score += 15

    if score >= 60:
        return "high", score
    elif score >= 30:
        return "medium", score
    return "low", score

const emailRisk = "high";
const containsPaymentRequest = true;

if (emailRisk === "high") {
  console.log("Display red warning banner in email client");
}

if (emailRisk === "high" && containsPaymentRequest) {
  console.log("Trigger two-step verification workflow");
  console.log("Create internal confirmation form before payment approval");
  console.log("Notify chief accountant and IT team");
}

#!/bin/bash
INCIDENT_ID=$(date +%s)
echo "[${INCIDENT_ID}] Suspicious email detected" >> security_incidents.log
echo "Create ticket for IT review"
echo "Send summary to operations manager and leadership team"