BLUETEAM ACADEMY — PHISHING AWARENESS FIELD GUIDE Microsoft 365 / Entra, Google Workspace and AI threats Course edition: October 2026. Follow your organisation's approved procedures. 1. PAUSE AND INSPECT THE REQUEST What am I being asked to change, disclose, authorize, pay, download or run? Was I expecting this work? Does the sender have authority for this action? A familiar name, logo, existing thread, correct grammar, HTTPS, voice or video does not answer those questions. A genuine account may be compromised. 2. VERIFY WITHOUT USING THE MESSAGE'S ROUTE Use an established bookmark, company launcher, service desk or stored contact. For payments and bank-account changes, follow callback and dual-approval rules. Do not call a number supplied by the suspicious request or approve an exception because the request claims urgency, secrecy or seniority. 3. LINKS AND QR CODES If your client offers a safe preview, inspect the full destination without opening it. The host is not a brand name appearing earlier in a subdomain or later in a path. A shortened URL or QR code can hide the destination. Do not open a link to test whether it is safe. Use the known business service directly. 4. MICROSOFT DEVICE CODES AND CONSENT A real Microsoft page can authorize a request started by an attacker. Do not enter a device code from an unsolicited meeting, recruiter or support message. Only complete a device flow you deliberately initiated for a known, approved app. Signing in is different from granting an application permission to mail or files. Verify the app identity, requested scopes, business purpose and approval status. Never approve an unexpected MFA prompt, including at the request of a caller. 5. GOOGLE WORKSPACE A real Drive sharing notification does not establish that the document is safe. An external document or Calendar invitation can contain an unsafe link or request. Use the known Drive/Calendar route and verify the business purpose separately. Review third-party app permissions with IT. Removing access later cannot recover data already copied. Google also supports legitimate device authorization; treat unexpected device instructions as an authorization question, not a brand question. 6. AI, COLLABORATION AND ATTACHMENTS Convincing voice/video does not replace identity and payment approval controls. An AI summary can repeat malicious instructions from a document it summarized. External Teams or Chat messages require the same checks as email. Do not open password-protected archives to evade scanning, run executables or enable macros just to read a document. A fake CAPTCHA or meeting repair may ask you to paste and execute a command. Stop: do not execute it. Do not install an unapproved browser extension or remote-support tool. 7. VIRUSTOTAL DECISION TREE — BEFORE ANY QUERY OR SUBMISSION A. Does company policy and the service's terms permit this use? NO / UNSURE -> use the approved internal security channel. B. Does the file or indicator contain confidential, personal or access information? YES / UNSURE -> do not upload or paste it into public scanning services. Examples: payroll, contracts, patient/customer data, private share links, password-reset links, signed download URLs, access tokens and internal details. C. For a permitted file already safely held, is an approved SHA-256 available? Ask security or use an approved local tool without executing the file. Do not download a suspicious attachment just to obtain its hash. D. Search the permitted hash for an EXISTING report. This does not upload the file's bytes, but still discloses the query to a third party. A missing report means unknown; it does not authorize a file upload. E. For a permitted public URL, check that the complete string has no sensitive information before querying. URL searches may be scanned and shared; do not assume that a search is private or that stripping a token tests the same object. F. Check the analyzed identifier, file type, analysis date and individual results. Zero detections is not proof of safety. An old report may not describe current content. A detection may require interpretation; do not override company tools. G. A report does not approve a payment, consent grant, sign-in or release of data. Follow the approved investigation and escalation process. WHY CONFIDENTIAL FILES MUST STAY OUT Ordinary VirusTotal submissions and reports can be shared within its security ecosystem, including partners and customers. Public scanning may create a new data disclosure. Private Scanning is a separate service that must be approved and configured for your organisation. Merely logging in or paying is not enough. If you accidentally submitted sensitive material, report that disclosure promptly; do not assume that deleting a local copy or changing the filename reverses it. 8. INCIDENT REPORT TEMPLATE — USE ONLY APPROVED INTERNAL CHANNELS Account / device affected: Approximate time and time zone: Channel and claimed sender: What I observed: What I actually did (viewed / clicked / entered password / completed MFA / entered device code / granted app access / ran content / sent data / paid): Any downloads, prompts or changes noticed: What I have stopped doing: Where original evidence is retained using the approved reporting tool: Known service-desk or security route used: Report quickly even if uncertain. Do not repeat the action to investigate. Do not put passwords, recovery codes or secrets in the report. Security may need to revoke sessions and app grants, inspect mailbox rules and review devices; a password change alone is not a complete response to every case. For payments, alert finance and security immediately through established channels. Follow response-team instructions rather than improvising device wipes or changes. REFERENCES https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/ https://support.google.com/mail/answer/8253 https://support.google.com/accounts/answer/14012355 https://docs.virustotal.com/docs/how-it-works https://docs.virustotal.com/docs/searching https://docs.virustotal.com/docs/results-reports https://docs.virustotal.com/docs/private-scanning Use fictional or sanitized examples in course responses. Do not paste actual suspicious files, private links or company secrets into the training platform.