Abstract:Context: In the digital age, there is a notable increase in fraudulent activities perpetrated by social engineers who exploit individuals' limited knowledge of digital devices. These actors strategically manipulate human psychology, targeting IT devices to gain unauthorized access to sensitive data. Objectives: Our study is centered around two distinct objectives to be accomplished through the utilization of a serious game: (i) The primary objective entails delivering training and educational content to participants with a focus on phishing attacks; (ii) The secondary objective aims to heighten participants' awareness regarding the perils associated with divulging excessive information online. Methodology: To address these objectives, we have employed the following techniques and methods: (i) A comprehensive literature review was conducted to establish foundational knowledge in areas such as social engineering, game design, learning principles, human interaction, and game-based learning; (ii) We meticulously aligned the game design with the philosophical concept of social engineering attacks; (iii) We devised and crafted an advanced hybrid version of the game, incorporating the use of QR codes to generate game card data; (iv) We conducted an empirical evaluation encompassing surveys, observations, discussions, and URL assessments to assess the effectiveness of the proposed hybrid game version. Results: Quantitative data and qualitative observations suggest the "PhishDefend Quest" game successfully improved players' comprehension of phishing threats and how to detect them through an interactive learning experience. The results highlight the potential of serious games to educate people about social engineering risks. Conclusion: Through the evaluation, we can readily arrive at the following conclusions: (i) Game-based learning proves to be a viable approach for educating participants about phishing awareness and the associated risks tied to the unnecessary disclosure of sensitive information online; (ii) Furthermore, game-based learning serves as an effective means of disseminating awareness among participants and players concerning prevalent phishing attacks.

Exploring Historical and Emerging Phishing Techniques and Mitigating the Associated Security Risks

Discover and Automate New Adversarial Attack Paths to Reduce Threat Risks for The Security of Organizations

Reviewing Cyber Security Social Engineering Training and Awareness Programs—Pitfalls and Ongoing Issues

Phishing and Spear Phishing: examples in Cyber Espionage and techniques to protect against them

Patching the “human” in Information Security: Using the Inoculation Defense to Confer Resistance Against Phishing Attacks

Phishing - A Growing Threat to E-Commerce

Defending against Phishing Attacks: Taxonomy of Methods, Current Issues and Future Directions

Multilayer Approach to Defend Phishing Attacks

Don’t click: towards an effective anti-phishing training. A comparative literature review

Analysis of Phishing Attacks and Countermeasures

SOK: A Comprehensive Reexamination of Phishing Research from the Security Perspective

Prevention of Phishing Attacks Using AI-Based Cybersecurity Awareness Training

Internet-based Social Engineering Attacks, Defenses and Psychology: A Survey

Internet-Based Social Engineering Psychology, Attacks, and Defenses: A Survey

An Overview of Phishing Victimization: Human Factors, Training and the Role of Emotions

Navigating Cybersecurity Training: A Comprehensive Review

Spear phishing in a barrel: Insights from a targeted phishing campaign

Educating and Raising Awareness on Cyber Security Social Engineering: A Literature Review

Can serious gaming tactics bolster spear-phishing and phishing resilience? : Securing the human hacking in Information Security

Walkthrough phishing detection techniques

Why Johnny can't rely on anti-phishing educational interventions to protect himself against contemporary phishing attacks?