# Malware awareness resources > Free Australian malware awareness posters, staff tips and ready-to-send > internal comms. Licensed CC BY 4.0. **Licence.** Everything here is CC BY 4.0: print it, adapt it, add your own logo, distribute it internally or externally, no permission needed and no cost. Keep the attribution line. Internal emails need no attribution at all. **Why it exists.** Almost all free awareness collateral is American, so it cites US agencies and US law. These are written for Australian workplaces and Australian obligations. **Independent.** malware.com.au is not affiliated with, endorsed by or connected to any government agency. Posters carry no government contact details by design: they point staff at their own IT team, and the official reporting routes are on the site. ## Posters A3 portrait vector, scaling cleanly to A4 or A2. Two themes each: dark for screens and digital signage, light for printing. ### Before you install it Audience: All staff > Most infections start with a download that looked fine. 01. The top search result can be a paid ad for a fake installer. 02. Go to the vendor’s own site and download from there. 03. Cracked software is the most common way passwords get stolen. 04. Found a USB stick? Hand it to IT. Do not plug it in. 05. If IT did not approve it, ask before you install it. Download: https://www.malware.com.au/posters/before-you-install-light.svg (print) · https://www.malware.com.au/posters/before-you-install-dark.svg (screen) ### Not all MFA is equal Audience: All staff > Strongest at the top. If you can choose, choose higher. 01. Passkey or security key. Cannot be phished. Use this. 02. App prompt with a number to match. Strong. 03. Six-digit code from an app. Phishable if you are rushed. 04. Code by text message. Weakest, and defeated by SIM swap. 05. Nobody legitimate will ever ring and ask you for a code. Download: https://www.malware.com.au/posters/mfa-not-equal-light.svg (print) · https://www.malware.com.au/posters/mfa-not-equal-dark.svg (screen) ### Six signs it is phishing Audience: All staff > Any one of these is enough to stop and check. 01. It is urgent, and something bad happens if you do not act now. 02. It arrived unexpectedly, with an attachment you did not ask for. 03. The link text and the real destination do not match. Hover and look. 04. It asks you to log in, or to confirm a password. 05. The sender address is almost right. Almost. 06. It asks you to keep it quiet, or to skip the usual process. Download: https://www.malware.com.au/posters/phishing-red-flags-light.svg (print) · https://www.malware.com.au/posters/phishing-red-flags-dark.svg (screen) ### Stop. Check. Report. Audience: All staff > Three seconds now beats three weeks of recovery. 01. Unexpected attachment or link? Do not open it. Ring the sender. 02. Asked to log in from a link? Type the address in yourself instead. 03. Bank details changed on an invoice? Ring a number you already had. 04. Clicked something you regret? Report it straight away. You are not in trouble. Download: https://www.malware.com.au/posters/stop-check-report-light.svg (print) · https://www.malware.com.au/posters/stop-check-report-dark.svg (screen) ### Think you have been hit? Audience: All staff > Do these five things, in this order. 01. Do not turn the computer off. Memory holds the evidence. 02. Unplug the network cable, or turn off Wi-Fi. 03. Ring IT now. Then ring them again if nobody answers. 04. Do not delete anything, including the email. 05. Write down what you saw and what time you saw it. Download: https://www.malware.com.au/posters/think-youve-been-hit-light.svg (print) · https://www.malware.com.au/posters/think-youve-been-hit-dark.svg (screen) ## Co-branded posters Any poster can carry an organisation's name. Build the URL directly: https://www.malware.com.au/posters/custom.svg?poster=&org=&theme= Nothing is stored: the name is used once to draw the poster and never logged. Full spec at https://www.malware.com.au/poster-generator.md ## Also here - [How to avoid malware](https://www.malware.com.au/avoid-malware.md): plain-English guidance for anyone who does not work in IT, at work or at home. - [Ready-to-send staff comms](https://www.malware.com.au/staff-comms.md): copy-paste emails for new starters, suspicious-email alerts, post-incident notices and payment fraud. - [Cyber Security Awareness Month kit](https://www.malware.com.au/awareness-month.md): a four-week October plan, about two hours of work in total. --- General information only, not legal advice. https://www.malware.com.au/awareness/