Phish Trap Escape

STATION 1 // HINT LEVEL 2 SOLUTION CLUE

All 3 messages are phishing scams! Count = 3. Take Alpha Value (3), Beta Value (8), Gamma Value (4), and Count (3) to get 3 8 4 3.

STATION 2 // HINT LEVEL 1 NUDGE

Only one link is safe. Check Link 3: does the domain end directly in powergrid-corp.com without weird extra extensions or hyphens?

STATION 2 // HINT LEVEL 2 SOLUTION CLUE

Exclude Link 3 (Token X). Read the tokens of malicious links 1, 2, 4, 5 in sequence: H - A - L - T. The override word is HALT.

STATION 3 // HINT LEVEL 1 NUDGE

A standard document has a single harmless extension like .pdf or .docx with 0 threat weight. Files with executable payloads or macro requests add threat weight!

STATION 3 // HINT LEVEL 2 SOLUTION CLUE

File B is safe (0). Add weights of dangerous files A (2000) + C (400) + D (80) + E (9). The total numeric hash is 2 4 8 9.

STATION 4 // HINT LEVEL 1 NUDGE

For Lock 04, note the Vector Digit printed at the bottom right of each wiretap card. Assemble them in order of items 401 through 404.

STATION 4 // HINT LEVEL 2 SOLUTION CLUE

Vector digits: 7, 1, 5, 2 → Lock 04 is 7152. For the master override, letter 2 is 'A', which converts to '1' using Page 1.

POST-ESCAPE CLASSROOM DEBRIEF DISCUSSION QUESTIONS (10-15 MIN)

1. The Psychological Trap: Why do phishing attacks almost always create a sense of intense urgency (e.g., "15 minutes or terminated")? How does adrenaline impair logical thinking?

2. The Out-of-Band Rule: If your boss or school principal emails asking for gift cards or emergency credentials, what is the single safest action to take before clicking or replying? (Call or verify in person).

3. Domain Dissection: Why do so many people fall for links like paypal.com.account-verify.net? Where should you look to find the true domain?

4. Multi-Factor Authentication (MFA): Even if an attacker steals your password, how does a second authentication step (authenticator app/hardware key) stop the breach?

PHISH TRAP TEACHER MANUAL // HINT SYSTEM & DEBRIEF PAGE 2 OF 3

CLASSIFIED // ANSWER KEY

MASTER SOLUTION KEY & INCIDENT RATIONALE

ALL PASSCODES VERIFIED

LOCK 01 (INBOX) 3843 Msg values + count

LOCK 02 (LINKS) HALT Malicious URL tokens

LOCK 03 (VAULT) 2489 2000 + 400 + 80 + 9

LOCK 04 (SOCIAL) 7152 Wiretap vector digits

FINAL MASTER OVERRIDE KEY (PAGE 5): Position 1: H | Pos 2: 3 | Pos 3: 1 | Pos 4: 4 | Pos 5: 7 | Pos 6: T

H   3   1   4   7   T

STATION 1 BREAKDOWN // LOCK 01 = 3843

• Message Alpha (Value 3): Phishing. The sender address ends in auth-portal9.com, a brand impersonation domain. Uses artificial 15-minute panic.

• Message Beta (Value 8): Phishing. Classic CEO gift card spear-phishing fraud sent from an external personal Gmail account (executive.office8812@gmail.com).

• Message Gamma (Value 4): Phishing. Displayed sender is internal benefits, but the Reply-To directs responses to harvest-inbox@stealth-domain.cc.

• Digit 4 Calculation: Total phishing emails detected = 3. Algorithm yields: [3][8][4][3] → 3843.

STATION 2 BREAKDOWN // LOCK 02 = HALT

• Link 1 (Token H): Malicious. Typosquatting uses numeral '0' instead of 'o' in micros0ft-support.com.

• Link 2 (Token A): Malicious. citibank.com is placed inside the subdomain; the true domain is verify-security-alert.org.

• Link 3 (Token X): Legitimate! Registered domain is genuine powergrid-corp.com with valid HTTPS. Discarded!

• Link 4 (Token L): Malicious. Plain unencrypted HTTP, generic name with Russian top-level domain (.ru).

• Link 5 (Token T): Malicious. Domain is customer-billing-reactivate.co, not authentic netflix.com.

• Assembly: Malicious tokens in order spell H - A - L - T.

STATION 3 BREAKDOWN // LOCK 03 = 2489

• File A (Weight 2000): Malicious double extension (.pdf.exe). Windows executes the binary.

• File B (Weight 0): Clean benign PDF document. Standard application/pdf MIME type.

• File C (Weight 400): Malicious macro-enabled Word file (.docm) prompting user to run script code.

• File D (Weight 80): Malicious archive containing hidden Visual Basic Script (tracking_manifest.vbs).

• File E (Weight 9): Malicious screensaver executable (.scr), an ancient Windows binary execution trick.

• Sum: 2000 + 400 + 80 + 9 = 2489.

STATION 4 & MASTER KEY // LOCK 04 = 7152 & FINAL KEY = H3147T

• Wiretap 401 (Digit 7): Smishing using fear & urgency of bank account closure.

• Wiretap 402 (Digit 1): Vishing (voice call) impersonating executive authority to bypass rules.

• Wiretap 403 (Digit 5): Smishing using scarcity & greed lure ($500 gift card, only 3 left).

• Wiretap 404 (Digit 2): Chat pretexting exploiting human desire to help a new coworker.

• Master Sequence: Pos 1: Letter 1 of Lock 2 (H) | Pos 2: Digit 1 of Lock 1 (3) | Pos 3: Letter 2 of Lock 2 ('A' converts to 1) | Pos 4: Digit 2 of Lock 3 (4) | Pos 5: Digit 1 of Lock 4 (7) | Pos 6: Letter 4 of Lock 2 (T) → H3147T.

PHISH TRAP TEACHER MANUAL // MASTER KEY & EXPLANATIONS PAGE 3 OF 3