Phishing and Training

Phishing is one of the six attack types of the card duel, and Training is the defence that counters it. Here you will find what they stand for in real security, how they face each other in the game and all 17 of their cards.

The attack: Phishing

Phishing targets people instead of computers: a message (email, text, phone call, chat) pretends to be a bank, a courier or a colleague to convince someone to click a link, open an attachment or hand over a password. It is the entry point of most real incidents, because no technical flaw is needed: a moment of haste or misplaced trust is enough.

The defence: Training

Training makes people part of the defence: awareness courses, phishing simulations and clear rules, such as checking the sender, not opening unexpected links and reporting anything suspicious right away. A trained person spots the bait before it does damage, and an organisation where reporting is easy discovers attacks in minutes instead of weeks.

What stops what

Training against Phishing: half damage. Someone who recognises a suspicious message does not click and reports it: the bait catches nothing.
Phishing against Firewall: double damage. The email arrives through normal, allowed channels, and it is a person who lets the attacker in from the inside: port rules see nothing strange.
Phishing against Patch: double damage. There is no software bug to fix: the weak point is the trust of whoever reads the message.
Exploit against Training: double damage. The exploit hits a service without anyone having to click anything: people’s attention does not stop it.
Malware against Training: double damage. Once running, malware acts and spreads on its own: it no longer asks anyone for permission.

In every other match-up damage is normal.

Combos with Phishing

Delivery (Phishing → Malware, +2 damage): the bait message carries the malware inside, as in most real infections.
Credential theft (Phishing → Brute force, +2 damage): passwords obtained through phishing make login attempts far more effective.
Reconnaissance (Scanning → Phishing, +2 damage): knowing who works where and with which systems makes phishing believable.

Phishing attack cards (12)

Bait email

#001 · Attack · Phishing · ◆1 · power 2 · Common · Arena 1 (Laboratory)

A generic message asking you to click a link. Works on the distracted.

Smishing

#016 · Attack · Phishing · ◆1 · power 1 · Common · Arena 1 (Laboratory)

Phishing by text message: “your parcel is on hold, tap here”. Low damage, but you draw a card.

Mass spam

#024 · Attack · Phishing · ◆0 · power 1 · Common · Arena 1 (Laboratory)

Costs nothing, deals little damage.

Vishing

#025 · Attack · Phishing · ◆2 · power 3 · Rare · Arena 1 (Laboratory)

The opponent discards 1 random card.

Spear phishing

#002 · Attack · Phishing · ◆3 · power 5 · Rare · Arena 2 (Corporate network)

Phishing tailored to one specific person, with real details taken from social media.

Evil twin

#172 · Attack · Phishing · ◆2 · power 2 · Common · Arena 2 (Corporate network)

A fake Wi-Fi access point with the same name as the real one: whoever connects hands over their credentials. Stopped by WPA3 Enterprise, certificates and a VPN. Draw a card.

ARP spoofing

#176 · Attack · Phishing · ◆3 · power 3 · Rare · Arena 2 (Corporate network)

The attacker poses as the router to make traffic pass through their hands (man-in-the-middle). Stopped by ARP inspection and managed switches. On their next turn the opponent cannot play supports.

CEO fraud

#003 · Attack · Phishing · ◆5 · power 8 · Epic · Arena 3 (Data center)

A fake email from the boss asking for an urgent transfer. Costs companies billions.

Watering hole

#026 · Attack · Phishing · ◆4 · power 5 · Epic · Arena 4 (SOC)

2 damage to every enemy defense.

DNS poisoning

#099 · Attack · Phishing · ◆4 · power 3 · Rare · Arena 5 (Cloud)

Forges DNS answers to redirect users to fake sites. The strongest enemy defense returns to its owner’s hand.

Phishing as a service

#206 · Attack · Phishing · ◆3 · power 3 · Rare · Arena 6 (Dark web)

Ready-made kits for rent: even someone who knows nothing can launch a campaign. Your attacks deal +2 damage this turn.

Voice deepfake

#224 · Attack · Phishing · ◆3 · power 3 · Rare · Arena 8 (Zero-day)

A cloned voice of an executive asks for an urgent action. Answered with a code word and calling back on a known number. For 2 turns the opponent draws one card less.

Training defence cards (5)

Awareness course

#043 · Defense · Training · ◆2 · toughness 4 · Common · Arena 1 (Laboratory)

Basic training: spotting suspicious emails and strange links.

Phishing simulation

#044 · Defense · Training · ◆3 · toughness 6 · Rare · Arena 2 (Corporate network)

Fake phishing campaigns to train people in the field.

In-house red team

#064 · Defense · Training · ◆5 · toughness 7 · Epic · Arena 7 (Cyber range)

Counterattack: whoever hits it loses 2 integrity.

Elite blue team

#109 · Defense · Training · ◆5 · toughness 7 · Epic · Arena 7 (Cyber range)

The best defenders: trained, tight-knit, used to responding under pressure. Counterattack: whoever hits it loses 2 integrity. Repairs allies: +1 toughness to your other defenses at turn start.

Cyber range

#111 · Defense · Training · ◆5 · toughness 9 · Legendary · Arena 7 (Cyber range)

A virtual proving ground where teams train on realistic attacks. Counterattack: whoever hits it loses 2 integrity. Regenerate: +1 toughness at turn start. Attrition: at turn start the strongest enemy defense loses 1.

Related guides

To learn the technical side there are the simulated labs:

The other card groups

All cards and the type chart