Avito and BI.ZONE Launch Cyberdetective CTF for Non-Technical Employees Focused on Phishing and Social Engineering

Avito and BI.ZONE have introduced Cyberdetective, a jeopardy-format Capture the Flag competition designed exclusively for non-technical employees who do not write code. The event formed part of Cybersecurity Week and served as a pilot project aimed at lawyers, recruiters, accountants, product managers, and support staff who represent the primary targets of real-world attacks.

Between Technical CTF and Quiz

Traditional technical CTFs require participants to find vulnerabilities, analyze files, or decrypt messages, skills that exclude most employees. Avito wanted to retain the competitive element and self-discovery aspect while removing the coding barrier. The resulting Cyberdetective format kept flags, scoring, and leaderboards but used a separate platform with tasks focused on recognizing web threats and making safe choices.

Two parallel technical CTFs ran during the same week for security specialists. Cyberdetective provided a distinct entry point for the broader workforce through scenarios involving social engineering, phishing, metadata inspection, and file verification.

Main Mechanic: Reward for Resilience

Many tasks actively encouraged participants toward unsafe actions. Flags were awarded when users recognized the risk and selected the secure path instead. One example involved an AI assistant requesting excessive OAuth permissions; the flag required rejecting the request and correctly identifying unnecessary rights rather than simply clicking decline.

This approach trains the specific skill of distinguishing legitimate requests from dangerous ones under time pressure, rather than teaching blanket refusal. Additional tasks required active investigation such as comparing visible link text with actual destinations, extracting hidden instructions from PDFs, or analyzing QR code output.

Topics Selected from Real Attacks

Every scenario mapped to current MITRE ATT&CK techniques, including T1566.002 Spearphishing Link, T1528 Steal Application Access Token, T1621 Multi-Factor Authentication Request Generation, T1036.007 Double File Extension, T1027.006 HTML Smuggling, and T1204.004 Malicious Copy and Paste. Prompt injection attacks against language models were also included, referencing their presence in OWASP Top 10 for LLM Applications.

Key Findings and Adjustments

Participants often became stuck not on complex logic but on recognizing that an object required any action at all. A base64 string ending in equals signs or an unfamiliar domain name did not trigger investigation for many non-technical users. Organizers added indirect hints such as “The flag looks strange? It may be wrapped in something” to preserve the spirit of discovery while reducing silent drop-off.

Security tools sometimes flagged the exercise materials themselves because the simulated phishing emails and macro documents were indistinguishable from real attacks. Registration remained open, allowing some technical staff to finish quickly, yet several non-technical participants also reached the maximum score over multiple days.

• 104 registered
• 44 reached solved tasks
• 16 achieved full points

The pilot demonstrated that a hands-on competition format can deliver practical experience beyond traditional awareness courses for employees outside information security roles.