On June 4th, 2024, I had the opportunity to attend the first-ever Phishathon of Belgium. This event, organized by Outkept, specialized in phishing. The Phishathon consisted of three stages/challenges: writing the best spear phishing challenge to get the most interaction within UZ Leuven, creating the best phishing email using AI tools, and a vishing challenge where we had to call someone to extract information.

Event Background

Outkept, the organizer of the event, is known for conducting ethical phishing campaigns for companies to raise awareness about phishing and teach people how to recognize phishing attempts. They also have an ethical phishing community where individuals can create phishing emails and earn money based on their effectiveness. This event was organized specifically for this community.

Stage 1: Spear Phishing Challenge

The first stage required us to create a spear phishing email for the IT department of UZ Leuven. We had about a week to prepare and submit this email a week before the event so it could be tested within the department. Together with Thor Demeestere, I created an email about a new event flyer that needed to be checked and printed. Although our email had a few openings, no one interacted with it initially. However, to our surprise, we secured third place for this stage because a few people downloaded the attachments from our email around 16:00 on the day of the event.

The event began with revealing the points for the first stage. Each team explained how they created their emails and why they chose specific topics.

Stage 2: Phishing Email with AI Tools

The second stage involved creating the best phishing email using AI tools. We were given 30 minutes to craft and submit our emails. Following this, each participant presented their email and explained how they utilized AI tools, while a jury awarded points based on creativity and effectiveness.

Dinner Break

After the second stage, we enjoyed hot pizzas from the pizzeria downstairs, providing a pleasant break and an opportunity to relax and network.

Stage 3: Vishing Challenge

The final stage was a vishing challenge. We divided into two groups, each assigned a target to call and extract information from. We had 10 minutes to prepare a story. Our group targeted the owner of a beer brewing company, pretending to be from the "Brussels Beer Contest" scheduled to be held in Ghent. Dellia made the call while we supported her with notes and guidance. Our efforts paid off as we won this round.

Conclusion and Networking

The day concluded with the announcement of the overall winner of the event, Noa, who received well-deserved congratulations. We then had a brief networking session before everyone gradually headed home. I stayed a bit longer to help clean up and catch up with my former colleagues before leaving.