For educators

Use this library to examine how impersonation, urgency, authority and misleading interfaces influence decisions. It includes reported incidents, research demonstrations and advisories. These categories describe different kinds of evidence and should not be treated as equivalent successful attacks.

In the classroom

• Compare a phishing case with a voice-impersonation case. Identify the claimed authority, requested action and independent verification opportunity.
• Trace an attack sequence and propose controls at each step. Distinguish recommendations from controls the organization actually deployed.
• Compare the case narrative with its cited sources. Separate allegations, attributed reporting and established historical events.
• Examine a financial account. Distinguish money transferred from recoveries, insurance, court orders and broader economic costs. Do not infer a typical loss from this selected collection.

The cases contain examples of malicious instructions and commands as documentary evidence. Treat them as inert text; do not execute them or visit attacker infrastructure for an exercise.

Using the dataset

CSV and JSON downloads are available on the dataset page under the repository’s stated license. Cite the dataset version and release date you used, together with relevant original sources. The case count and category totals are calculated for each release. A future dataset deposit must be confirmed before a DOI is advertised for that version.

The collection is curated, not a statistical sample. AI-assisted drafting and review are part of its preparation; citations and explicit limitations remain necessary. Historical legal events are dated accounts, not current docket or custody checks. See the methodology and limitations pages for the review process and evidence boundaries.