Cybersecurity Masterclass

Every day brings new reports of phishing attacks, yet few people understand what real-world phishing actually looks like. Phishing is no longer limited to suspicious links and poorly written messages. Today’s attackers operate at an entirely new level, using generative artificial intelligence, deepfakes, fake QR codes, social media accounts, and collaboration platforms. These techniques enable them to gain users’ trust and obtain access to accounts, confidential information, and financial assets. Developed by CASE as part of Cybersecurity Awareness Month, this masterclass introduces participants to the latest methods used in phishing and social engineering attacks. Through real-world examples, participants will learn how to recognize the early warning signs of an attack, verify suspicious requests, and respond appropriately to potential incidents. The masterclass places particular emphasis on attacks that are becoming increasingly difficult to detect using traditional warning signs, including convincing AI-generated messages, MFA fatigue attacks, session hijacking, and fraud conducted simultaneously across multiple communication channels. Participants will receive practical recommendations and simple verification techniques that can be applied both in the workplace and to protect their personal accounts and information.

What you'll learn

• Identify the key warning signs of modern phishing attacks;
• Critically assess deepfake audio and video communications;
• Safely verify QR codes, links, domains, and authentication requests;
• Recognize suspicious MFA prompts and OAuth permission requests;
• Distinguish attacks delivered through email, social media, and workplace collaboration platforms;
• Detect manipulation based on urgency, authority, and emotional pressure;
• Respond safely to suspicious messages and report incidents appropriately;
• Apply practical security measures to reduce phishing risks within an organization.

Syllabus

• Deepfake-Driven Vishing▾

  • -AI-generated voice and video impersonation;
  • -Calls impersonating an executive, colleague, or family member;
  • -Verifying urgent financial requests;
  • -Secure callback and identity-verification protocols.
• Pretexting With Generative AI▾

  • -Personalized and convincing fraudulent scenarios;
  • -The use of information gathered from open sources;
  • -Manipulation based on context, emotion, and authority;
  • -Verifying information through an independent communication channel.
• Identity and Authentication Attacks▾
• MFA Fatigue Attacks▾

  • -The purpose of repeated authentication requests;
  • -Fraudulent IT support calls;
  • -Responding safely to unexpected MFA prompts;
  • -Additional measures for protecting user accounts.
• OAuth Consent Phishing▾

  • -Granting access to fraudulent or malicious applications;
  • -Evaluating requested permissions;
  • -Identifying suspicious applications and integrations;
  • -Reviewing and revoking previously granted access.
• Evil Proxy Phishing▾

  • -Impersonation of legitimate login pages;
  • -The risk of password and active-session theft;
  • -An overview of techniques used to bypass multi-factor authentication;
  • -Phishing-resistant authentication methods.
• Links, Domains, and Web Technologies▾
• QR Code Phishing — Quishing▾

  • -Redirecting users to malicious websites through QR codes;
  • -Fraudulent QR codes placed in physical locations, emails, and documents;
  • -Safely checking a web address before opening it;
  • -Verifying payment and authentication QR codes.
• Homograph Phishing Domains▾

  • -The use of visually similar letters and symbols;
  • -Distinguishing fraudulent domains from legitimate web addresses;
  • -Verifying domains and security certificates;
  • -The risks associated with shortened links.
• Man-in-the-Browser Phishing▾

  • -Manipulation of information displayed in the browser;
  • -Risks associated with malicious extensions and compromised devices;
  • -Identifying suspicious redirects and unexpected changes;
  • -Practical rules for protecting browsers and user accounts.
• Zero-Day Phishing Kits▾

  • -Rapidly changing phishing pages and templates;
  • -An overview of techniques used to evade traditional security filters;
  • -Early warning signs of emerging phishing campaigns;
  • -User-behavior-based defensive measures.
• Threats Delivered Through Files and Web Content▾
• HTML Smuggling▾

  • -Creating malicious files through the victim's browser;
  • -The risk of bypassing security filters;
  • -Assessing unfamiliar HTML files and downloads;
  • -Safe procedures for opening files and reporting suspicious content.
• Custom Attachment Malware▾

  • -Malicious attachments tailored to a specific recipient;
  • -Risks associated with Office documents, PDFs, archives, and other file types;
  • -The use of password-protected archives in phishing attacks;
  • -Verifying the sender and context before opening a file.
• Multi-Channel and Organizational Phishing▾
• Multi-Channel Business Email Compromise▾

  • -The coordinated use of email, phone calls, and messaging applications;
  • -Impersonating an executive or business partner;
  • -Requests to change bank details or transfer funds;
  • -Independently verifying financial transactions.
• Social Media Phishing▾

  • -Fake profiles and compromised accounts;
  • -Fraudulent job, prize, and customer-support offers;
  • -Malicious links sent through direct messages;
  • -Privacy and account-security settings.
• Phishing via Collaboration Tools▾

  • -The misuse of Microsoft Teams, Slack, and other collaboration platforms;
  • -Fraudulent invitations, files, and authentication requests;
  • -Identifying external users and unfamiliar integrations;
  • -Reporting suspicious activity within the organization.
• Practical Simulation and Incident Response▾

  • -Step-by-step analysis of a phishing attack;
  • -Verifying the message, sender, link, and request;
  • -Making a safe and informed response decision;
  • -Documenting and reporting the incident to the appropriate team;
  • -Immediate steps to take when an account may have been compromised;
  • -Creating a practical anti-phishing checklist for the organization.