Cybersecurity Threats: Phishing & Malware

Active learning works well for cybersecurity because students must develop instinctive recognition of subtle cues in emails and messages. Role-plays and simulations mirror real-world urgency, building habits that static lessons cannot. When students handle mock threats directly, they internalize safe practices instead of just memorizing definitions.

• Year 7
• Computing
• 4 activities
• 30 min–45 min

Learning Objectives

1. Analyze the common tactics used in phishing attempts to deceive individuals.
2. Differentiate between at least three types of malware (e.g., virus, trojan, ransomware) and explain their distinct impacts.
3. Evaluate personal online behaviours and propose specific strategies to mitigate the risk of phishing and malware infection.
4. Explain why cybercriminals target individuals, citing at least two motivations.

Stations Rotation

⏱ 45 min·Small Groups

Stations Rotation: Threat Identification Stations

Prepare four stations with sample phishing emails, malware descriptions, hacker motivation articles, and defence checklists. Students rotate every 10 minutes, annotating examples and discussing traits in their groups. End with a class share-out of key findings.

Prepare & details

Explain why hackers target individuals rather than just large corporations.

Facilitation Tip: During Threat Identification Stations, circulate with a checklist of common phishing signs so students practice using the same criteria experts rely on.

Setup: Tables/desks arranged in 4-6 distinct stations around room

Materials: Station instruction cards, Different materials per station, Rotation timer

• Remember
• Understand
• Apply
• Analyze
• Self-Management
• Relationship Skills

Escape Room

⏱ 30 min·Pairs

Pairs: Phishing Email Dissection

Provide pairs with three emails: one real phishing, one safe, one borderline. Pairs highlight red flags like poor grammar or urgent demands, then justify classifications. Pairs present one email to the class for peer vote.

Prepare & details

Analyze the common characteristics of a phishing attempt.

Facilitation Tip: While students dissect phishing emails in pairs, listen for them to justify their choices using evidence from the message headers or links.

Setup: Group tables with puzzle envelopes, optional locked boxes

Materials: Puzzle packets (4-6 per group), Lock boxes or code sheets, Timer (projected), Hint cards

• Remember
• Apply
• Analyze
• Relationship Skills
• Self-Management

Escape Room

⏱ 40 min·Whole Class

Whole Class: Malware Simulation Game

Use a digital tool or board game where malware spreads across a network of student 'devices.' Students vote on actions like updating software to contain it. Debrief on real-world impacts and prevention.

Prepare & details

Differentiate between various types of malware and their impact.

Facilitation Tip: In the Malware Simulation Game, step back after the first round to let groups self-correct rather than correcting them immediately.

Setup: Group tables with puzzle envelopes, optional locked boxes

Materials: Puzzle packets (4-6 per group), Lock boxes or code sheets, Timer (projected), Hint cards

• Remember
• Apply
• Analyze
• Relationship Skills
• Self-Management

Escape Room

⏱ 35 min·Individual

Individual: Defence Strategy Posters

Students research one defence method, such as recognising phishing or using antivirus. They create posters with steps and examples, then gallery walk to peer-review and add feedback.

Prepare & details

Explain why hackers target individuals rather than just large corporations.

Facilitation Tip: During the Defence Strategy Poster task, remind students to include both technical fixes and personal habits in their designs.

Setup: Group tables with puzzle envelopes, optional locked boxes

Materials: Puzzle packets (4-6 per group), Lock boxes or code sheets, Timer (projected), Hint cards

• Remember
• Apply
• Analyze
• Relationship Skills
• Self-Management

Teaching This Topic

Teachers should avoid presenting cybersecurity as a set of rules to memorize. Instead, treat it as a skill to rehearse under pressure, much like fire drills. Research shows that students retain more when they experience near-miss scenarios and reflect on their close calls. Always connect lessons back to real consequences so the topic feels urgent rather than abstract.

What to Expect

Successful learning shows when students confidently identify phishing red flags in unfamiliar messages and explain why layered defences beat single tools. They should articulate hacker motives and adjust their own online behaviour without prompting. Posters, discussions, and exit tickets reveal this understanding clearly.

Watch Out for These Misconceptions

Common Misconception

During Station Rotation: Threat Identification Stations, watch for students assuming phishing emails always come from unknown senders.

What to Teach Instead

Use the station’s mixed set of mock emails, some from familiar names like teachers or banks, to show how hackers exploit trust. Have students rank messages by believability before revealing which are fake.

Common Misconception

During Malware Simulation Game, watch for students believing antivirus software will catch every threat.

What to Teach Instead

After the simulation, display mock scan results that miss new malware variants. Ask groups to explain why their layered habits—like checking file types—matters when tools fail.

Common Misconception

During Pairs: Phishing Email Dissection, watch for students assuming hackers only target big organisations.

What to Teach Instead

Share real case studies of individual victims during the discussion. Ask pairs to map motives to impacts, showing how stolen social media details fuel broader fraud.

Assessment Ideas

Exit Ticket

After Station Rotation: Threat Identification Stations, give each student three short email snippets. Ask them to label which is phishing, justify their choice with two red flags, and write one action they would take to stay safe.

Discussion Prompt

During Pairs: Phishing Email Dissection, pose the question: 'Why might a hacker prefer your school email password over a bank’s database?' Circulate to listen for answers that cite value of individual data and lower security of personal accounts.

Quick Check

After Defence Strategy Posters are complete, collect them and highlight two common phishing clues (e.g., urgent language, mismatched URLs). Ask students to circle these on their own posters and write a one-sentence reflection on why these matter.

Extensions & Scaffolding

• Challenge students who finish early to craft a phishing email that would fool someone with only one red flag visible.
• Scaffolding: Provide a partially completed poster template with key headings and sentence starters for students who struggle with structure.
• Deeper exploration: Ask students to research a recent ransomware case and add a short paragraph to their posters explaining how it spread and how victims could have defended themselves.

Key Vocabulary

Phishing	A fraudulent attempt, usually made through deceptive emails, messages, or websites, to trick individuals into revealing sensitive information like passwords or credit card details.
Malware	Short for malicious software, this includes viruses, worms, trojans, ransomware, and spyware designed to harm or exploit computer systems or data.
Ransomware	A type of malware that encrypts a victim's files, demanding a ransom payment, typically in cryptocurrency, to restore access.
Trojan Horse	Malware disguised as legitimate software or a useful file, which, once executed, allows attackers to gain unauthorized access or cause damage.
Social Engineering	The psychological manipulation of people into performing actions or divulging confidential information, often used as a component of phishing attacks.