✨ Personalised
🛡️ 2026 Threat Intelligence · 10 Scenarios
Can you spot the phish?

These scenarios are designed to fool you. Each one is borderline — the kind of attack that gets past experienced people every day.

📧 Email Phishing
💼 BEC Fraud
📱 Smishing
📞 Vishing
🔗 OAuth Abuse
🔒 ProtonMail Spoof
💬 Spear Phishing
🎭 Impersonation
🎣
Preparing your training…
🔍
Researching your organisation
🎯
Building personalised attacks
🚀
Preparing your scenarios
We're researching public information about your organisation to make these phishing simulations as realistic as possible. No data is stored.
1 / 10
What's your verdict on this message?
0
pts

0
Correct
0
Missed
0
Lives Left
🏆
Claim Your Certificate
Download your official FreshPhish completion certificate to share with your team.
🔒 accounts.g00gle.com/signin/oauth/v2/cert-verify

Sign in to Google to generate your certificate

Google
D
Verify your identity
FreshPhish Certificate Service is requesting access to your Google account
Email or phone
Password
🎣
You just got phished.
You completed a phishing awareness game — and then handed over your credentials on the very last screen.

This is the most important lesson of the whole training:

Attackers know you've had security training. So they attack you right after — when your guard is down and you feel accomplished. A fake "get your certificate" prompt with a Google login is one of the most effective social engineering tricks in use today.

🔴 Wrong domain: The URL was accounts.g00gle.com — two zeros, not two O's.
🟡 No reason to sign in: A training certificate never requires your Google credentials.
🟡 Urgency + reward combo: A shiny "Get Certificate" button right after success lowers your critical thinking.

✅ Your real password is safe — this was a simulation. No data was sent anywhere.

🦅
Truly elite.
You spotted the trap that most people miss — even after completing phishing training.

You noticed something was off and refused to enter your credentials. Here's what should have tipped you off:

🔴 Wrong domain: The URL was accounts.g00gle.com — two zeros, not two O's. Always check the URL bar before typing a password.
🟡 No reason to sign in: A completion certificate never requires your Google credentials.
🟡 Post-training trap: Attackers deliberately target people right after security training, when their guard drops.

Share this game with your team — the final trap is the most valuable lesson.