https://forum.defcon.org/ DEF CON 34 en Tue, 19 May 2026 20:39:00 GMT vBulletin 60 https://forum.defcon.org/images/misc/rss.png https://forum.defcon.org/ https://forum.defcon.org/node/255740 Mon, 18 May 2026 21:39:14 GMT CONTEST RUNS THROUGH JUNE 21! SEE CONTEST OVERVIEW AND RULES FOR DEF CON 34 --> https://forum.defcon.org/node/255739
FULL RULES AND SCENARIO ALSO AVAILABLE AT --> https://phishstories.org

For our newest installment of Phish Stories we’re going to the movies! This time, in the great city of Chicago, Illinois. Enjoy!

The Grand Parkway 34 Multiplex opened in Chicago in the fall of 2023 with oversized ambition and a name to match. Built on the site of the old Parkway Theater, it became the largest movie theater in the Midwest, boasting 34 screens, wall-to-wall recliners, powerful sound, and blockbuster dreams.
Carved out in one wing of the theater sits eight screens devoted to a curated screening room experience run by longtime staff member and noir film fan Hank Marlowe. Carrying on the tradition he had started at the old Parkway, Hank’s double-feature nights were crafted with love. And for a while, the combination of old and new worked. Crowds showed up. Blockbusters packed the main screens while Hank’s nostalgic corner drew a respectable following.


But once the newness faded, the Grand Parkway fell victim to the same declining crowds affecting theaters across the industry. The multiplex’s parent company, BroadSwitch Studios, took notice and decided it was time to chase a new audience. Their focus fell on Hank’s screening room, which, while beloved, was not pulling in enough revenue.

Their replacement? A cloud-streamed, real-time entertainment zone known as the Digitally Enhanced Fan Connection, or DEF CON for short. The new setup will feature live sports, reality television, esports tournaments, and a rotating lineup of video podcasts. It is marketed as the next phase of moviegoing, a place where groups can react to the moment together.

The idea came from Timmy Goodson, a smooth-talking entrepreneurial minded promoter who believes the only thing holding the theater back is outdated thinking. Timmy has been installed at the Grand Parkway to oversee the rollout and make sure the launch hits on schedule.

The person trying to keep the technology from melting down is Alexis Romero. She started at the theater early on and somehow became its unofficial IT department. Now she is juggling cloud credentials, vendor instructions, and a dozen systems she was never formally trained on. Alexis is also working toward a security degree at a local community college, so she has a pretty good idea of just how wrong things can go.

The general manager, Malcolm Shaw, is doing everything he can to maintain order. He lived through the demolition of the original Parkway Theater and has no intention of letting this new version fail.

And then there is Hank, still recommending 1940s crime films to confused teens at the concession counter. He is having a hard time believing that podcast panels and influencer watch parties are replacing the classic double feature.

The DEF CON launch is only days away. The staff is tired. The systems are untested. The stakes feel high.

This year’s Phish Stories challenge invites you to explore the real-world risks that appear when a company races forward with new technology faster than its people can keep up.

We’ll grab the popcorn. You write the phish. Make someone click, make us laugh, and win your way into DEF CON this year.]]> Phish Stories Serum https://forum.defcon.org/node/255740 https://forum.defcon.org/node/255739 Mon, 18 May 2026 21:29:10 GMT

CONTEST RUNS THROUGH JUNE 21! FULL RULES AND SCENARIO ALSO AVAILABLE AT --> https://phishstories.org

I’m an avid fisherman, so I know a thing or two about a fish story. That 12-inch bass somehow becomes a 2-foot monster when you’re telling it. I’m also a hacker with a security day job, so I know a thing or two about the other kind of phishing too. Turns out both have something in common: you’re proclaiming something incredible and hoping someone bites.

Years ago, the bad ones were easy to spot. Nigerian princes, unclaimed lottery winnings, mysterious government agents with secrets only you could know. They were so bad I often wondered if the goal was ever really to get someone to click, or just to make someone laugh. I thought, why not make it both?

That’s Phish Stories. Write a phishing e-mail that gets someone to click and makes the judges laugh. We’ve set the stage with a fictional company, fictional targets, and plenty of background material. The rest is up to you.

How Do I Win?
The best entry will find a way to combine clickability with laughability, what we like to call “targeted absurdity.” A hilarious backstory paired with a phishing e-mail that would actually hook someone is the sweet spot. It’s a delicate balance, but that’s what makes it fun.
That said, you don’t have to nail both. There are three ways to win:

• The Ruler – The best overall combination of clickability and humor. A creative backstory that builds into a phish that leaves us rolling. This is our overall winner.
• The Wizard – The most convincing, technically sound phishing e-mail. Humor is optional here, it’s all about whether your target would actually click.
• The Jester – The entry that made us laugh the most. Maybe it’s not the most clickable, but it’s the one we’ll remember.

Submission Rules
Each submission has two parts:

• The backstory – Tell us about your target, why you chose them, what assumptions you made, and what happens after they click. Be creative. This is where you fill in the blanks. 600 words or less.
• The e-mail – The phishing e-mail itself. 600 words or less. Optional header information does NOT count against the word limit.

The 600-word limit is strictly enforced. Entries over the limit will be penalized during judging.
Save both to a single text file, attach it to an e-mail, and send it to: phishstories@protonmail.com
Contest runs May 10th through June 21st at 11:59pm Las Vegas time.
One entry per participant. If you send more than one, we’re only reading the first.
You’ll receive a confirmation within 48 hours. If you don’t hear back, reach out.
A few other things to keep in mind:

• No illustrations or graphics.
• Include your e-mail address and alias or hacker name (real name is fine too).
• Do not include DEF CON staff or goons without their EXPRESS WRITTEN PERMISSION, which must be forwarded to phishstories@protonmail.com along with their contact info. We’ll verify before allowing the entry.

---

Scoring
A panel of judges will individually stack rank all entries across six categories:

• E-Mail Clickability – Would your target actually click?
• Use of Sources – Did you read the scenario? There are nuggets in there, some not so obvious.
• After the Click – What happens when they do click?
• E-mail Humor – Did the e-mail make us laugh?
• Backstory Humor – How about the backstory?
• Creative Ingenuity – How outside-the-box did you go?

Winners are selected as follows:

• Ruler – Highest combined score across all 6 categories
• Wizard – Highest score in Clickability + Use of Sources + After the Click + Creative Ingenuity
• Jester – Highest score in E-mail Humor + Backstory Humor + Creative Ingenuity

The Ruler is named first. The remaining entries are then ranked to determine the Wizard and the Jester. One winner per category.
Judging will be completed within two weeks of the contest closing.

---

Prizes (In-Person at the Con)

• Ruler – 2 Human Badges
• Wizard – 1 Human Badge
• Jester – 1 Human Badge

Winners get recognition in the online program and on social media. If you’re on-site at DEF CON, you’ll walk the stage at the Contest Closing Ceremony. We’ll also post every entry in the DEF CON Forums for everyone to enjoy.
Check out last year’s scenario, entries, and winners if you want to see what you’re up against.

---

Stay in the Loop
Follow us for updates:

• BlueSky – @phishstories.bsky.social
• Defcon.social – serum@defcon.social
• Reddit – u/phishstories

Questions? E-mail us at phishstories@protonmail.com

Enjoy!
​
​
​
​
​]]> Phish Stories Serum https://forum.defcon.org/node/255739