Threat library

Real playbooks, dissected.

Every entry is a scheme running in the wild right now: how it looks on arrival, where the hook hides, and the tell you can catch in three seconds. New cases added as they are verified.

Library in progress

Four playbooks are published so far. New ones are written as they are verified against at least two independent sources, so the library grows slowly on purpose. Subscribe below and each one lands in your inbox as it goes up.

WHICH OF THESE LANDED ON YOUR PHONE THIS WEEK?

Channel
4 / 4 CASES
SMS

“Your parcel could not be delivered”

SMS FROM +44 7911 284551

DHL: Your parcel DE4820771903 is on hold due to an unpaid customs fee. Confirm your details and pay €0.99 within 24h or the parcel will be returned to sender: dhl-parcel-redelivery.com/track

HOOK · RED FLAGS · WHAT TO DO→
SMS + PHONE

“Did you authorize a €499 charge?”

SMS FROM BANKALERT

Security alert: Did you authorize a payment of €499.99 to AMZN MKTP? Reply NO if this wasn't you. A fraud specialist will contact you shortly.

HOOK · RED FLAGS · WHAT TO DO→
EMAIL

“Are you at your desk? Quick favor.”

FROM Thomas Weber <t.weber.ceo@gmail-secure-mail.com>

Are you at your desk? I'm heading into a board meeting and can't take calls. I need you to pick up 5x €100 Apple gift cards for a client appreciation - scratch the codes and email them to me. Keep this between us for now, it's a surprise. Will reimburse after. Sent from my iPhone

HOOK · RED FLAGS · WHAT TO DO→
EMAIL

“Please note our new bank details”

FROM Accounts <invoicing@nordvik-logistics.com>

Hi, following our bank migration please use the new account for this and all future invoices: IBAN LT60 3250 0473 1108 2914, BIC REVOLT21. Invoice 2026-0917 (EUR 18,400) is attached again for convenience and falls due Friday. Apologies for the extra admin. Kind regards, Marta

HOOK · RED FLAGS · WHAT TO DO→

Think you would catch all of them? Reading is not the same as recognising.

Prove it in 60 secondsWork a full shift