An agent opens an email asking him to revalidate his HR access. The link leads to a page identical to MaBoxRH, group logo included. Except that the domain in the address bar does not correspond to anything known. This scenario directly affects users of GTm Extranet La Poste, and the convergence initiated since 2024 between MaBoxRH, GTm Extranet, and the Smart Portal has multiplied the connection paths.
Result: the usual landmarks are blurred, and phishing campaigns exploit precisely this confusion.
Workstation and locked session: the foundation before the password
The security of an extranet is not limited to the password. On GTm Extranet, the workstation used to connect is the first link to verify. A shared computer without automatic session locking, a browser that saves credentials in an unprotected profile, an operating system with security updates lagging for weeks, all create vulnerabilities well before the password is entered.
Specifically, three points are checked before each connection:
- The workstation is a professional terminal with an up-to-date operating system and browser (security patches regularly fix vulnerabilities exploited by phishing kits).
- The user session is locked as soon as the workstation is left, even for a few minutes, preventing a third party from accessing an open GTm session.
- The password manager integrated into the browser is disabled or protected by a master password, to prevent physical access to the workstation from granting direct access to HR credentials.
A guide on authentication on GTm Extranet La Poste also details fake login sites and common scam techniques on this platform.
Securing the workstation reduces the attack surface even before discussing the password. The CNIL also incorporates all these measures into a comprehensive data protection approach, not as isolated actions.
Multifactor authentication on GTm Extranet: what it protects and what it does not
Multifactor authentication (MFA) adds a layer of verification after the password: a temporary code received via SMS or generated by an app. One might think that this is enough to block any attempt at fraud. In practice, it is not that simple.
A well-constructed fake login page can capture both the password and the MFA code in real-time. The user enters their credentials on the fake site, the hacker instantly forwards them to the real portal, retrieves the requested MFA code, and logs in before expiration. This type of attack, called “real-time phishing,” makes the second factor ineffective if the domain has not been verified beforehand.
MFA remains a relevant security measure, but it is part of a broader system. It never exempts one from checking the URL before any input. On GTm Extranet, an internal recommendation circulated since 2024 is clear: never access GTm via a search engine. One should go through a saved favorite or the group’s intranet.
Check the domain in three seconds
Before entering anything, one should look at the browser’s address bar. The domain must exactly match that of the official portal. An extra character, an unusual hyphen, a different extension: close the tab. A valid HTTPS certificate (green padlock) does not guarantee the legitimacy of the site, as SSL certificates are available for free, even for fraudulent sites.
Incident response procedure after entering information on a fake site
Spotting a phishing attempt is one thing. Knowing how to react after entering credentials on a suspicious page is another. This procedure should be prepared before an incident occurs, not after.
Here is the sequence to follow if one suspects having entered their GTm Extranet credentials on a fraudulent site:
- Immediately interrupt the current session and do not click on any other links on the same page.
- Log in to the official portal (via a verified favorite) and change the password without delay.
- Notify the IT department or internal support of the La Poste group so they can monitor suspicious connections on the account.
- Keep the fraudulent message (email, SMS) without deleting it: it will serve as proof for the report.
- Check recent activities on the HR account to spot any unusual access or modifications.
This incident preparation logic aligns with the recommendations published by the CNIL in 2024: managing a compromise is planned before fraud, not in an emergency.
Organized reporting: who to notify and through which channel
Reporting a fake site or phishing email is not limited to deleting it from the inbox. For the report to be useful, it must go through the right channel.
Internally, the first reflex is to contact the group’s IT support. Depending on the structure, a dedicated form or reporting address exists. The goal: to allow the security service to block the fraudulent domain for all users and check if other accounts have been targeted.
Externally, the official Pharos platform (reporting illegal online content) allows one to declare a phishing site. Feedback on processing times varies, but the report feeds into a database that accelerates blocking by browsers and internet service providers.
Avoid recurring traps related to search engines
Sponsored pages imitating GTm Extranet may appear at the top of search results. Typing “GTm Extranet La Poste” into a search engine is the most common attack vector. Access should always be through a manually saved favorite link or from the group’s intranet portal.
A strong password, an activated second factor, and an up-to-date workstation are useless if entered on the wrong page. Securing access to GTm Extranet relies on a series of simple checks, applied systematically, without exception for “quick” connections between meetings.
