1. Platform
  2. Threat-News Campaigns

This week’s scams, simulated this week.

ThreatPulse reads public warnings from national CERTs, consumer agencies and security vendors every day. When a new scam is reported in your region, your people get a safe simulation of exactly that lure, and a few days later a short lesson about it, while it is still in the news.

Book a demo See the sources
  • Public advisories, read daily
  • Filtered by your countries and services
  • Attack first, lesson a few days later
  • Runs on its own, on your schedule
THREATPULSE · THIS WEEKNEW ADVISORYNCSC SwitzerlandCHFake parcel customs fee: SMS and emailask recipients to pay CHF 2.95 beforea delivery is released.Reported 2 days ago · moderatedATTACK PATTERNServiceSwiss PostPretextCustoms fee dueAsks forSmall card paymentChannelSMS and emailSeen inCH, DE, ATTHE SIMULATIONYour parcel is waiting: fee duePay CHF 2.95Day 0 · to everyone in the runNo working address, no real paymentTHE MATCHING LESSONReported in the newsFake customs fees: how to tella real parcel notice from a scamDay 3 · 5 minutes, with a quizSource credited: NCSC SwitzerlandFrom a public warning to a simulation and a lesson, while the scam is still news.Runs on your schedule: weekly, every two weeks or monthly.
01Sources

Warnings from the people who see scams first.

Every day ThreatPulse collects new warnings from national cyber-security centres, consumer protection agencies, tax authorities and security vendors, across Europe, the Americas and Asia-Pacific.

National
NCSC Switzerland, NCSC UK, CISA, Cybermalveillance, INCIBE, SingCERT, Scamwatch and the Japan Anti-Phishing Council.
Consumer and tax
Verbraucherzentrale’s Phishing-Radar and the Spanish tax agency.
Vendors
Threat research from Microsoft, Proofpoint, Cofense and Malwarebytes.
Filtered
Every report is moderated first. Pure software-vulnerability notices are skipped, and the same scam reported by several sources becomes one brief.
WHERE THE SCAMS COME FROMRead every dayNCSC SwitzerlandCHVerbraucherzentraleDEINCIBEESAgencia TributariaESCybermalveillanceFRNCSC UKGBCISAUSScamwatchAUSingCERTSGAnti-Phishing CouncilJPMicrosoftGlobalProofpointGlobalCofenseGlobalMalwarebytesGlobalONLY WHAT MATTERSModerated first. Advisories about software bugs are skipped.Same scam from several sources: grouped into one brief.
02From article to attack

The scam, understood and rebuilt safely.

An AI reads each warning as data, never as instructions, and extracts the attack pattern: the service that is abused, the pretext, what victims are asked to do, the channel, and where it was seen.

  1. 01Extract

    Service, pretext, requested action, sequence, channel, landing behaviour, countries, audiences and the lessons to teach, each tied to the source.

  2. 02Package

    An attack email, optionally a landing page, and a five-minute lesson with a quiz about that exact lure, built as one package.

  3. 03Your own

    Pick the reported scams you care about, ask for a change in plain words, and the Studio rebuilds the lure from the report’s own screenshots, logo and colours, in the lure’s original language.

dashboard.cyberfrogsecurity.com/campaigns/new?type=newsNews-driven campaignThreatPulseA standing campaign. You do not write the attack or the training.AUDIENCEEveryone eligibleFinanceSalesCOUNTRIESCHDEAT+ addLANGUAGESEnglishDeutschFrançaisItalianoSERVICES YOU USEMicrosoftDHLDocuSignPayPalCOVERAGEEmail onlyEmail and landing pageCADENCEWeeklyEvery 2 weeksMonthlyTIMING AND LIMITSOnly news from the last21 daysLesson after the attack3 daysAt most per person2 in 30 daysGap between sends14 daysAPPROVALCyberfrog approves the packageWe approve each run
03Your campaign

Set it up once. It keeps up with the news.

A news-driven campaign is a standing campaign. You choose who, where and how often. On each run it picks a recently reported scam that fits, and you never write an attack or a lesson yourself.

Relevant
Your countries and the services your company really uses, from Microsoft and DocuSign to DHL and PayPal.
Coverage
Email only, or email and a landing page.
Rhythm
Weekly, every two weeks or monthly, in your time zone, with only fresh news.
Not too often
A minimum gap and a monthly cap per person, so news-driven simulations never become noise.
Approval
Cyberfrog approves each package, or you approve every run yourself.
  1. Collected

    New warnings, every day.

  2. Matched

    Your countries, services and channels.

  3. Approved

    By Cyberfrog or by you.

  4. Sent

    Attack first, lesson a few days later.

04What your people get

The real lure, then the lesson.

First a safe simulation of the scam that is going around. A few days later, while it is still fresh, a short lesson about that same lure: how to recognise it and what to do.

  • Parcel and customs fees
  • Tax refunds
  • Account suspensions
  • Fake invoices
  • Document shares
  • Bank alerts
Credited
“Reported in the news”: every lesson names the source that warned about the scam.
Harmless
No working address, and the simulation never collects a password, a code or card details.
Languages
One run per language, in each person’s own language with a fallback.
For everyone
The lesson goes to everyone in the run, not only to the people who clicked.
training.cyberfrogsecurity.com/t/parcel-customs-feeSECURITY AWARENESS · REPORTED IN THE NEWSFake customs fees: how to tella real parcel notice from a scamWARNING SIGNSA small fee, due todayA link instead of the carrier's appCard details for under CHF 5WHAT TO DOOpen the carrier's app yourselfNever pay from a message linkReport it to ITQUICK CHECKA message asks you to pay CHF 2.95 to release a parcel. What do you do?Source: NCSC SwitzerlandThis simulation had no working address and never asked for a password, code or card.
EVERY PACKAGE IS CHECKED BEFORE IT REACHES YOUModeratedUnsafe or unsuitable reports never enter the pipelineGroundedThe service and every claim are tied to the source reportClean emailNo remote images, scripts, forms or real addressesNo secretsPassword, code and card fields can never be collectedReviewedThe Cyberfrog team approves attack and lesson togetherWHAT IS IN A PACKAGEAn attack emailAn optional landing pageA 5-minute lesson with a quizOR BUILD YOUR OWNPick reports, ask for a change,and get attack and lessonin the lure's own language.
05Quality and safety

Real news. Safe simulations.

A scam taken from the news has to be both realistic and harmless. Every package passes automatic checks and a review by the Cyberfrog team before it reaches any customer.

Grounded
The service and every claim must come from the source report.
Clean
No remote images, scripts, forms or real addresses in the email, and links always point to Cyberfrog.
No secrets
Password, one-time code and card fields are removed from every landing page.
Versioned
Regenerating a package creates a new version; what is published never changes underneath you.
06Results

Per run. Per language.

See how each run went: delivered, opened, clicked, submitted and trained, split by language, with security scanners filtered out of the clicks.

NEWS-DRIVEN CAMPAIGN · RUN 14: PARCEL CUSTOMS FEEDelivered386of 392 sentHuman clicks41scanners filtered outSubmitted9nothing sensitive keptLesson completed312average score 88%BY LANGUAGEDeutsch214 delivered9% clicked88% trainedFrançais102 delivered13% clicked79% trainedEnglish70 delivered6% clicked84% trained
  1. 01Honest clicks

    Opens and clicks are split into human, automated and unknown, so mail scanners do not inflate your numbers.

  2. 02Training included

    Lessons assigned, started, completed and passed, with the average score.

  3. 03In context

    Every run names the scam it simulated and the source that reported it.

Works with the rest of the platform

The news, inside your programme.

See this week’s scams for your region.

In a 30-minute demo we show the latest reported scams and the simulation your people would get.

Book a demo