Alderbridge Arts Festival · Response desk · 08:55–16:55 UTC · Five independent phishing drills
You are on duty when ordinary invitations start asking for extraordinary trust. Follow the evidence, give people a safe next step and break the phishing chain.
Five free phishing missions. Follow the request, challenge the channel and protect the person behind the click.
Join the fictional Alderbridge Arts Festival response desk for five complete phishing investigations: changed payment instructions, a QR-benefits lure, a false calendar meeting, excessive app consent and a mailbox spreading the attack. Three levels progress from business verification to identity and campaign response. All five missions are free and open in any order, without prerequisite locks, payment or external tools. Practice as a guest; sign in before starting to save advancement and earned badges. Approximately 86 minutes total, with no countdown. Evidence is synthetic and informed by dated primary reporting/guidance. This is guided practice, not professional certification.
The festival's staging supplier needs paying before the trucks leave. An email inside the existing conversation changes the destination account. Finance wants your recommendation before releasing the batch. Follow the request, verify independently and decide what can proceed.
A polished benefits notice promises travel reimbursement before the festival. Its QR code moves volunteers from their work inbox to personal phones. One person only viewed the notice; another entered credentials. Decide who needs which response and keep a safe reimbursement route open.
Staff are about to join a sponsor briefing from a calendar invitation. The organiser name looks right, but the invitation's destination and the real sponsor's schedule disagree. Investigate both the message and the calendar copy, then keep staff connected through a verified meeting route.
A known journalist's message points to a file-sharing app called PressPack Viewer. The sign-in provider is genuine, but the app asks to read mail and retain access. A colleague clicked Allow. Investigate the permission grant, contain the app route and keep publication moving through the approved workspace.
Partners say a trusted festival coordinator is sending document requests and confirming that they are safe. The coordinator denies both. A password reset has happened, but the mailbox is still behaving strangely. Reconstruct the thread, address sessions and inbox rules, and leave the next shift a scoped recipient-response plan.