text: Appendix A
  Indicators
  A-79. Most common phishing techniques share certain traits, including—
  * E-mails with generic greetings. Note that spear phishing attempts are more sophisticated and
  address targeted individuals by name.
  * E-mails requesting personal information or login credentials.
  * E-mails requesting or demanding an urgent response.
  * E-mails with spoofed links—where the text displayed does not match the internet address shown
  when hovering over the link.
  Reaction
  A-80. If an individual suspects a phishing or spear phishing attempt, they should—
  * Report the attempt to the chain of command, automation support section, and G-2 (S-2).
  * Confirm the identity of the sender before taking any action.
  A-81. Individuals can further protect themselves from fraudulent links by never accessing their personal
  accounts through links in e-mails. For instance, if an e-mail purports to be from the individual’s bank or
  credit card company, they should access their account only through the legitimate secure website, not through
  a hyperlink provided in an e-mail.
  A-82. Commands should not threaten punishment against personnel who inadvertently fall victim to phishing
  attempts. Fear of punishment could prevent individuals from reporting attacks.
  Social Media Attacks
  A-83. Adversaries may conduct social media attacks in support of their information collection and
  information operations goals. All individuals using any form of social media are potential targets.
  Preventive Measures
  A-84. Individuals should strictly limit personal information posted to their social media accounts. The
  compromise of this information could be damaging in itself or could strengthen an adversary’s subsequent
  social engineering or spear phishing attacks.
  A-85. Individuals should restrict who can view their social media profile and activities using the privacy
  settings on the social media platform.
  A-86. Individuals and public affairs personnel must carefully weigh operations security considerations when
  they engage on social media platforms.
  A-87. Individuals and group administrators should not accept friend or group membership requests from
  unknown or unverifiable persons.
  A-88. Commands should consider limiting or restricting access to social media platforms as mission or
  operations security concerns dictate.
  Indicators
  A-89. Indicators of potential social media attacks include—
  * Friend requests from unknown persons, or duplicate friend requests that mimic a known person.
  * Unknown persons commenting on social media posts.
  Reaction
  A-90. If a social media attack is known or suspected, personnel should—
  * Report the suspected compromise to the G-2 (S-2).
  * Immediately change any passwords that might have become compromised.
  * Watch for indicators of identity theft.