Phishing Awareness

How to spot that it's phishing — and what to do about it

Rules of the game

Everything here is in a lab, with consent, for defense.

You confirmed this at registration — so, briefly:
we recreate attacks so that you can recognize them.

We do not attack people.

What we'll cover

1. What social engineering is + real cases
2. 10 signs of phishing
3. Game "Phishing or not?" (Google Quiz)
4. Live demo: GoPhish
5. Quishing (QR phishing)
6. Vishing + AI voice / deepfake
7. Hidden and malicious files
8. Modern attacks: when even MFA doesn't always save you
9. Final quiz

Social engineering targets emotions, not code

The attacker doesn't break the encryption — they make you click.

4 levers of influence:

• Urgency — "do it now, or else…"
• Authority — "it's the director / IT / the bank"
• Fear — "your account has been hacked"
• Curiosity/greed — "you've won", "look at this photo"

If a message makes you rush and feel — that's a red flag.

Types of social engineering

Real cases (this isn't theory)

Case	Year	How they broke in
Twitter (Musk, Obama)	2020	Vishing → internal panel
Uber	2022	MFA fatigue: 100 "Approve?" pushes
MGM / Caesars (casinos)	2023	Call to the helpdesk → MFA reset
Retool	2023	SMS + call + AiTM combined

The victims weren't "stupid". These were tech companies with MFA.

Classic bait

"Your Microsoft account is locked. Sign in here."

"Congratulations! You've won an iPhone "

"Urgently check the invoice (attachment)."

"Unusual sign-in to your account. Confirm your identity."

The common thread: urgency + an action + a link/attachment.

10 signs of phishing

1. Odd domain (microsft-login.com, paypa1.com)
2. Errors in the text / strange language
3. Urgency and pressure
4. Threats ("your account will be deleted")
5. Unusual attachment (.zip, .html, .iso)
6. QR code instead of a normal link
7. Asks for your password / MFA code
8. Asks you to pay urgently
9. Unusual sender (name ≠ address)
10. Suspicious links (hover, don't click!)

Sign #1 — domain and sender

The sender's name lies. The address tells the truth.

From: Microsoft Security <no-reply@microsft-secure-login.ru>
                          ^^^^^^^^ typo       ^^^ odd zone

• microsft instead of microsoft (typosquatting)
• paypa1 (a "1" instead of an "l")
• .ru / .xyz / .top where you'd expect .com
• a subdomain of lies: microsoft.login-verify.com → the real domain is login-verify.com!

Read the domain right to left: the last part before / is the real owner.

Sign #10 — links (hover!)

The link text ≠ where it leads.

Try it live — hover (do NOT click) over this "safe" link:

https://www.paypal.com/secure

↳ At the bottom of the browser / in the tooltip the real address appears: evil-login-verify.xyz

On a computer: hover the cursor, look at the URL at the bottom of the screen.
On a phone: long-press → show link.
Not sure — don't click, go to the site manually.

What if the email looks perfect?

Modern phishing has no typos (AI writes flawlessly).
Then a process works, not a "gut feeling":

• Pause. Is the email pushing you to hurry? That's already a signal.
• Second channel. Call/ask directly — don't reply to the email itself.
• Never enter a password/code via a link from an email.
• Report button in Gmail/Outlook — use it.

Verify, don't trust. This is Zero Trust for people.

Google Phishing Quiz (Jigsaw)

📱 Scan from the screen —
take it yourself

phishingquiz.withgoogle.com

Rules:

1. We look at an example email together.
2. We vote: Phishing or Legit?
3. We discuss why — what to look at.

What is GoPhish

An open-source platform for legal phishing simulations.

It shows what the attacker sees:

• who received the email
• who opened it
• who clicked the link
• who entered data on the fake page

Only your own test accounts / with consent. Passwords in the demo are fake.

GoPhish: anatomy of a campaign

Sending Profile  →  who sends (SMTP)
      +
Email Template   →  the email itself (HTML, with {{.FirstName}})
      +
Landing Page     →  fake login page (+ data capture)
      +
Users & Groups   →  who we send to (test accounts)
      =
        Campaign  →  launch + real-time dashboard

The defense visible here: technical mail checks make delivery of the forgery harder.

GoPhish: what it teaches defense

• You see how easily people click — without blame.
• A red "[EXTERNAL]" banner on mail from outside — simple but effective.
• Technical mail checks — make sender forgery harder.
• The Report Phishing button turns victims into a sensor.
• Regular simulations ↓ the click rate over time.

A look "under the hood" of the email

An email has technical checks of whether the sender is real — the mail system does them itself.

In Gmail: ⋮ → "Show original":

You see PASS — good. You see FAIL — a reason not to trust the email.

Quishing — why it's dangerous

A QR code = a link you don't see with your eyes.

• Bypasses email filters (it's just an image!)
• On a phone it's harder to check the URL
• Often in PDF "invoices", on "parking meters", "menus"

🔴 Scan it with your phone → see what happens (our page)

Defense: the camera shows the URL before opening — read it. Don't scan QR codes from random stickers.

Voice and video aren't proof either

A call "from the boss": authority + urgency + a familiar voice.

Why it works:

• authority ("it's the director / IT / the bank")
• urgency ("I'm in a meeting, quick")
• we're used to trusting a familiar voice

An AI voice clone is made from a few seconds of recording.
Deepfake video is already a reality too.

AI voice and deepfake: what it's already capable of

We watch 1–2 short videos — how convincing voice and face fakes have become.

• A voice clone from a few seconds of recording.
• Real-time deepfake video (a Zoom call "from the manager").

2024: a company in Hong Kong lost $25M — a transfer after a deepfake video call "from the CFO".

Conclusion: voice and video are no longer proof of identity.

Vishing: the "Zero Trust for voice" rule

Even if the voice sounds 100% like the boss:

• Stop if they ask for: a password, an MFA code, a transfer, gift cards.
• Call back a number you know (not the one that called).
• A code word for urgent financial requests.
• No legitimate service asks for a password by voice.

A voice is no longer proof of identity.

Data can be hidden in an ordinary file

An ordinary photo can contain hidden text — the eye sees no difference, the size is almost the same.

This is called steganography. It hides data (or commands for malware) "in plain sight".

Key idea: a file isn't always "just a picture" or "just a document".

Demo: when a "document" strikes instantly

I open an ordinary-looking document file in the browser…

→ it shows "You've been hacked!" and downloads a file to the computer by itself.

I didn't press any "Enable" — just opening it was enough.

Defense: don't open unexpected attachments, not even "invoices" and "documents". In doubt, ask the sender through a second channel.

Which files can be dangerous

We don't show working malware — the reflex is what matters:

• Office with "Enable Content" — that means "I allow code to run". A legitimate document doesn't ask for this.
• PDF / HTML — can contain scripts and lead to a fake login.
• Archives (especially password-protected) — hide the payload, bypass antivirus.

Defense: don't enable macros; don't open unexpected attachments; turn on file extensions (so you catch invoice.pdf.exe).

MFA: protects very well — but not 100%

MFA (two-factor) is one of the strongest defenses. Turn it on everywhere.

But it gets bypassed too:

• they send "Approve?" pushes again and again until the tired person taps "Yes" (that's how Uber was hacked).
• they steal an already approved session — getting in without a password and without a code.

Turn MFA on anyway — without it it's far worse. And the rule: "I didn't start a login → don't approve, press Report".

Threat landscape: summary

Kahoot — let's compete!

(game code on the screen)

10–15 questions: "Phishing or not?" + "What to do?"

Host: launch Kahoot, give the code, have fun. Questions — in 40_quiz/final-quiz.md.

Remember 5 things

1. Pause before you click — urgency is the signal.
2. Hover over links, read the domain (right to left).
3. Second channel — verify the request, don't trust the email/voice.
4. Never dictate a password/code — to anyone, anywhere.
5. Report — your button makes everyone safer.

Verify, don't trust.

Thank you!

Questions?

I'll hand out / send the cheat-sheet.
Google Phishing Quiz: phishingquiz.withgoogle.com
Check if your email has leaked: haveibeenpwned.com

Stay paranoid in moderation.