EXECUTIVE CYBERSECURITY TRAINING · DORA
BlueTeamACADEMY
Start 30-day demo

WORKFORCE CYBERSECURITY · PRACTICAL TRAINING

Phishing Awareness: Microsoft 365, Google Workspace & AI Threats

Practise recognising deceptive messages, device-code requests, malicious app permissions and AI impersonation. Inspect realistic screenshots, use VirusTotal safely and respond without exposing company data.

BlueTeam Academy
12 modules · 72 narrated slides20 screenshot exercisesApproximately 2–3 hours

VERIFY THE REQUEST

A convincing message is only the beginning.

Employees, managers, executive assistants, finance and HR teams using Microsoft 365 or Google Workspace. No technical background required.

Modern phishing can use a genuine Microsoft sign-in page, a real Google sharing notification, a familiar voice or a compromised supplier conversation. Work through fictional Northstar workplace cases and learn to inspect the requested action, verify independently and protect company information.

Examples cover Microsoft Entra and Microsoft 365, Google Workspace, device-code authorization, OAuth consent, session theft, QR codes, collaboration messages, AI-assisted fraud and fake verification prompts. The course teaches practical decisions without requiring learners to visit attack sites or handle malware.

FROM RECOGNITION TO RESPONSE

Twelve modules. Decisions you can use at work.

  1. 01

    Read the request, not the branding

    Separate a familiar appearance from verified authority and expected work.

    10–15 min
  2. 02

    Inspect links without taking the bait

    Identify the real host and use an independent route instead of testing suspicious links.

    10–15 min
  3. 03

    Microsoft device-code phishing

    Recognise an attacker-supplied device code even on a genuine Microsoft sign-in page.

    10–15 min
  4. 04

    Microsoft app consent and fake IT support

    Distinguish signing in from granting an application access to company data.

    10–15 min
  5. 05

    Google Workspace sharing and OAuth traps

    Evaluate Drive, Docs and Calendar lures and unexpected Google permission requests.

    10–15 min
  6. 06

    MFA fatigue and session theft

    Reject unexpected approvals and understand the limits of codes, MFA and password changes.

    10–15 min
  7. 07

    QR codes, Teams, Chat and mobile phishing

    Apply the same verification process across channels and smaller screens.

    10–15 min
  8. 08

    AI impersonation and payment fraud

    Verify identity and authority without relying on convincing text, voice or video.

    10–15 min
  9. 09

    Attachments, fake CAPTCHA and browser extensions

    Recognise unsafe execution and permission requests disguised as routine work.

    10–15 min
  10. 10

    VirusTotal: a safe investigation workflow

    Check permitted indicators or file hashes and interpret reports without treating them as clearance.

    10–15 min
  11. 11

    VirusTotal: protect confidential information

    Decide what must stay inside approved company analysis channels and why.

    10–15 min
  12. 12

    Report, contain and recover

    Report what happened promptly, preserve useful evidence and coordinate recovery.

    10–15 min
  13. ✓

    24-question scenario assessment · 80% pass mark

    Complete each module’s coached decision, separate knowledge check and written application before the final assessment.

LOOK. DECIDE. EXPLAIN.

Inspect the screen before making the call.

Labelled reconstruction of a meeting invitation asking for device-code authorization
One of 20 original, inert training reconstructions. Select the image to enlarge.

Practice with consequences

Each module has a case briefing, three teaching steps, a coached decision and a written application. Inspect screenshots at full size, reveal the teaching points and revise your choice after reviewing the consequences. English narration follows each slide.

Use VirusTotal without creating a data leak

Decide which indicators may be queried, use approved file-hash lookups, interpret report age and detections, and recognise when to stop. Confidential attachments and private sharing or reset links belong in approved internal investigation channels. A public scan can disclose the very information you are trying to protect.

Keep a practical field guide

Includes a message-inspection checklist, Microsoft and Google authorization checks, a safe VirusTotal decision tree and an incident-report template.

Download field guide (TXT) ↓

Course text, screenshots, field guide and assessments follow your selected language. Narration is being added by language. Screenshots are fictional teaching reconstructions, not evidence of real incidents; interfaces are simplified and may differ from your organisation’s configuration. No working attack links, usable device codes or executable commands are included. Complete all module work, save your professional role and pass the final assessment for a named completion certificate. Written work is retained for review, not independently graded. Completion is not a guarantee of threat detection.

Primary reference material

AI

Practical AI use, with human judgement.

This course includes role-specific ways to use approved AI assistance, relevant AI threats and failure cases, and checks for evidence, data handling and human approval. Optional prompts use fictional information; an AI account is not required.

AI examples are practical learning activities. They do not add statutory training requirements or replace your organisation’s policies, qualified advice or accountable decisions.

Download the AI workflow guide (TXT)