Phase 4 — Phishing engine

Phishing training thatfeels like a real job.

HookLine drops you into Orion Dynamics, a 180-person enterprise technology consultancy in Singapore. Real colleagues. Real projects. Real deadlines. And somewhere in the noise, a message that is trying to hook you.

180
Employees
6
Departments
4
Career paths
inbox · daniel.tay@oriondynamics.com.sg
Serena Koh

AP ageing report — please review before Friday run

Marcus Goh

Re: Q3 close checklist

Meridian Supplies Pte Ltdhook?

URGENT: Updated bank details for invoice #INV-88421

IT Service Desk

Windows 11 upgrade — your slot is confirmed

Your inbox opens as soon as you choose a career

Why this matters

Nobody falls for a phishing email. They fall for a Tuesday afternoon.

Phishing works because it hides inside ordinary work. The invoice arrives during quarter-end close. The password reset lands in the middle of an MFA rollout. The urgent request from a director comes while they are genuinely travelling.

Traditional awareness training shows you a suspicious email with no context and asks whether it looks suspicious. That is not the decision anyone actually has to make. HookLine gives you the context first — the company, the colleagues, the deadlines — and then asks you to make the call the way you would at work.

Context

You know who normally emails you

Harold Teng never asks for a payment over chat. When 'he' does, the anomaly is the tell — and you only notice it because you know him.

Pressure

Urgency is the oldest lever

Close week, a summit deadline, a locked-out director before a client meeting. Attackers borrow the pressure your job already creates.

Authority

Seniority short-circuits process

The hardest security decision is telling someone three levels above you that you need to verify first.

Habit

Your job is to open attachments

Marketing opens artwork. HR opens CVs. Finance opens invoices. 'Don't click things' is not advice anyone can follow.

Features

Built like a company, not like a quiz

Everything in HookLine exists to make one moment believable: the moment you decide whether to trust a message.

A company that actually exists

Orion Dynamics has 180 employees, three offices, a 2009 founding story and five live initiatives. Browse its corporate website at any point during the game.

People with histories

Every colleague has a biography, a manager, a team, a personality and a communication style. When something feels off, it is because you know how they normally write.

Role-specific exposure

An IT engineer gets targeted differently from a finance approver. Ten attack techniques, each aimed at the roles it would genuinely be aimed at.

Persistent relationships

Reporting lines, project teams, vendor contracts and each colleague's writing style stay consistent across the whole game, so context you learn in week one still matters later.

Safe by design

Nothing leaves the platform. No real emails are sent, no real addresses are used and no personal data is required to play.

Progress that persists

Register an account or play as a guest — either way your profile, career choice and progress are stored and waiting when you return.

How the simulation works

Five steps from stranger to insider

  1. 01

    Create your profile

    Register, or jump straight in with guest mode. Your progress is saved either way.

  2. 02

    Learn the company

    Read Orion's history, meet the leadership, walk the org chart and find out what Project Phoenix is and why everyone is stressed about quarter end.

  3. 03

    Choose your career

    Pick one of four roles. You inherit a real seat in the org chart — a manager, a team, live projects and a daily routine.

  4. 04

    Live the workday

    A working mail client with your onboarding inbox, the company knowledge base and a tutorial that teaches you how to investigate a message.

  5. 05

    Decide, then find out

    Trust, Report or Investigate. Every decision is explained in full: what the indicators were, what would have happened, and what to do next time.

  6. 06

    Work a whole week

    Five paced days of ordinary business — forms, invoices, approvals, meetings and vendors — so that normal becomes something you recognise rather than something you are told.

  7. 07

    Then it gets real

    Ten attack techniques woven into the same traffic, from invoice fraud to reply-chain hijacking. Eleven investigation checks, and an explanation of every decision either way.

About Orion Dynamics

The company you are about to work for does not exist. It just behaves as though it does.

Orion Dynamics is a Singapore-headquartered enterprise technology consultancy. We design, migrate and operate the core systems that regional banks, manufacturers and public-sector agencies depend on every day. Founded in 2009 above a coffee shop on Duxton Road, it now runs 180 people across Singapore, Kuala Lumpur and Ho Chi Minh City.

It has a mission statement nobody can quite recite, an ERP migration that is running slightly late, an ISO 27001 audit that everyone is nervous about, and a Tech Summit in eleven weeks with a supplier list growing by the day. That mess is the point: every one of those initiatives is a place an attacker can hide.

Live initiatives

  • Project Phoenix

    In flight — Phase 2 of 4

  • Orion Tech Summit 2026

    Planning — 11 weeks out

  • ISO 27001 Recertification Audit

    Stage 1 complete — Stage 2 fieldwork in September

  • Q3 FY26 Financial Close

    Active — close window opens in 9 days

  • FY27 Graduate Recruitment Programme

    Applications open — assessment centres in November

33 named colleagues with full profiles

3 offices across Singapore, Malaysia and Vietnam

Persistent reporting lines and project teams

Your first day at Orion starts now

Create a profile, meet your team and choose your career. No email is ever sent, no personal data is required, and guest mode takes one click.