Phish Myself: Design the Attack, Then Defeat It

The Garden State Cyber curriculum includes a "Phishing Myself" style project for a reason.

A phishing message becomes more believable when it uses information that feels personal and timely.

This lab lets you study that mechanism without sending a real phishing message to anyone.

You will create a fictional phishing artifact. You will not send it, deploy it, host a login page, collect credentials, or target a real person.

Build a fictional version of yourself

Create a synthetic profile with five harmless details such as:

• favorite game genre
• fictional club
• made-up competition date
• invented teacher name
• fictional streaming service
• fictional school event

Do not use real passwords, home address, phone number, private schedule, or other sensitive information.

The profile exists only to give the message context.

Design the pretext

Your phishing artifact needs a believable story.

Choose one:

• club registration problem
• game tournament invitation
• account storage warning
• school event schedule update
• prize or reward notice
• fake support request

Then define:

Claimed sender

Who does the message pretend to be?

Trigger

Why is the message arriving now?

Pressure

Urgency, authority, reward, fear, curiosity, or social proof.

Requested action

What does the message want the fictional target to do?

Asset at risk

What could be exposed if the target follows the request?

Create the artifact

Write a synthetic message containing:

• sender display name
• sender address using an obviously fictional domain such as .example
• subject line
• message body
• displayed fictional link

Example domain:

https://student-club-check.example/verify

Do not use a real organization's domain in a deceptive link.

Mark your own clues

Now switch roles.

Pretend you are the defender analyzing the message.

Highlight at least six clues.

Possible categories:

• sender mismatch
• unusual domain
• unexpected request
• deadline
• authentication request
• attachment
• emotional pressure
• request that violates normal procedure

For every clue, explain why it matters and why it is not proof by itself.

Build the attack/defense mirror

Create this table:

Add at least six rows from your artifact.

Use OSINT against your own design

Look at the fictional profile you created.

Which details made the pretext stronger?

Now redesign the profile so the same activity can still be promoted publicly while revealing less useful context.

Example:

Instead of publishing a detailed travel schedule, publish only the event name and general date.

The goal is not total secrecy. The goal is reducing unnecessary attack context.

Build a phishing-resistant process

Assume the target receives your synthetic message.

Design the safest workflow:

1. pause before acting
2. identify the requested action
3. inspect visible sender and link information
4. use an independent verification channel
5. open the known service directly if account action is needed
6. report the suspicious message
7. protect the account if information may have been exposed

Then identify where MFA, password uniqueness, reporting, and account monitoring fit into the process.

Peer red-team / blue-team review

Exchange only the fictional artifact with a classmate.

The reviewer should not know your intended clues.

They identify:

• strongest persuasion technique
• most suspicious clue
• most believable clue
• safest verification path
• one control that would reduce impact even if the target clicked

Compare the review with your original design.

If the classmate notices a different weakness than you expected, that is useful evidence about how humans read messages.

Debrief the ethics

Answer:

• Why was the artifact never sent?
• Why were fictional domains used?
• Why were real credentials excluded?
• Why did the activity still teach phishing mechanics without collecting victims?

A cybersecurity exercise should teach the mechanism without creating an unnecessary victim.

Evidence for Lesson 3

Submit:

• fictional profile
• synthetic phishing artifact
• six-clue annotation
• attack/defense mirror
• phishing-resistant workflow
• peer review notes
• ethics debrief

Finish with:

The detail that made my fictional phishing message most believable was ________. The safest defensive habit against that detail is ________.

The strongest phishing defense is not perfect suspicion. It is a verification process that stays reliable even when the message knows something about you.