OpsShield Confirms cPGuard Update Hijack Affecting 3,000 Servers
Attackers compromised the cPGuard update infrastructure to distribute a backdoor and a data-stealing script, affecting approximately 3,000 Linux servers.
Spot the Phishing
Free cybersecurity training. Thirty cases. Think before you click.
Think before you click
A familiar sender name can hide an unfamiliar request. Privacy Needle’s free Spot the Phishing game gives you a safe place to practise checking messages before trusting them. Investigate 30 fictional emails, examine destinations and attachments, and learn why the context matters.
How to play
- Choose Beginner, Intermediate or Expert.
- Read the message and verified case context.
- Inspect the complete sender address, link destination and any attachment metadata.
- Select supported warning signs and classify the message as phishing or legitimate.
- Review the explanation, then continue through ten cases.
Three levels, thirty investigations
Beginner introduces everyday scams and ordinary legitimate notifications. Intermediate covers workplace requests, attachments and payment verification. Expert adds targeted impersonation, session secrets and app permissions. Each level contains five phishing attempts and five legitimate messages. All levels are available without registration.
What is phishing?
Phishing uses deceptive messages to persuade someone to reveal a secret, transfer money, grant access or take another harmful action. It can arrive through email, text messages, chats or calls. A fluent message can be fraudulent, and a genuine message can be urgent. The useful question is whether the request matches an independently verified purpose and contact route.
Warning signs to investigate
- A destination that does not match the organisation’s established address.
- A request for passwords, recovery codes, session tokens or uninitiated MFA approvals.
- A new payment beneficiary without the usual independent checks.
- Instructions to ignore warnings, keep a request secret or bypass approvals.
- An unexpected executable disguised as a document.
What to do after spotting a suspicious message
Avoid replying, opening attachments or using its contact details. Report the message through your organisation’s established security process or your email provider’s phishing control. Verify any urgent claim using a saved app, bookmark or contact number. If you already gave away a secret, use the real service to change it and revoke unfamiliar sessions. Contact your bank promptly if a payment or financial account is involved.
Continue your cybersecurity training
The game’s reading centre rotates public Privacy Needle articles and checks for new posts every five minutes while open. This page’s related list updates when the page is generated; your WordPress cache may affect that interval.
Frequently asked questions
Can the simulations open malicious links?
No. Simulated addresses use reserved example domains. Inspection stays inside the game and attachments are text-only metadata.
Is there a time limit?
No. Optional time bonuses can be enabled, but there is no countdown or penalty for taking longer.
Is perfect grammar a sign that a message is safe?
No. Verify the sender, the request and the destination against independent information.
Do I need an account?
No. The standalone public game does not ask for registration, an email address or payment.
Does my result qualify me as a security professional?
No. This is educational practice, not certification or a complete assessment.
About Privacy Needle
Privacy Needle publishes reporting and practical guides on privacy, data protection, cybersecurity, AI governance and digital trust, with a focus on Nigeria and Africa.
Game privacy
Optional localStorage saves non-sensitive progress and preferences on this device. The game reads public post metadata from Privacy Needle. Article visits follow the publication’s own privacy rules. Analytics and advertising are disabled in the supplied release. You can remove saved progress and cached articles in the game’s Settings screen.