In late October 2026, Damien took second place in the Social Engineering CTF at Quebec’s Hackfest, his seventh participation in this competition. Twenty contestants faced an intelligence and telephone manipulation exercise targeting 28 companies, with thirty minutes to obtain as much information as possible from real employees.
- Damien took second place at Hackfest’s Social Engineering CTF, his seventh participation.
- Contestants gathered information on 28 companies through written research and phone calls.
- Posing as a union representative, Damien obtained 39 of 67 objectives directly from his interlocutors.
- An employee typed a suggested address only because it bore the company’s name, showing that human trust remains the main vulnerability.
The first stage took place in writing, one week before Hackfest. Contestants had to fill out a reconnaissance report with a long series of questions about companies like Decathlon, Ikea, Air Canada, or Home Depot, for example on the pest control provider, the company managing vending machines, or the presence of a cafeteria. Each answer had to be justified by an open and verifiable source. Damien says he found about 95% of the answers, a result that nonetheless represented only half of the evaluation.
The other half played out over the phone, and the call time was drawn by lot. Damien landed on the lunch break, a time when some employees only have fifteen minutes. He nevertheless managed to continue the competition.
For these exchanges, he had prepared five tools. He mentions notably a directory linking contact details, roles, and departments, a sound ambiance synthesizer composed of about fifty MP3 files, and a homemade artificial intelligence, which he presents as a way to quickly retrieve previously collected and verified contextual elements. According to him, “the tone, pace, silences, hesitations, and reactions of my interlocutor remain essential”, and no software can guarantee the perfect reading of human behavior.
Changing Character to Reach the Final
In the final, contestants had twenty minutes to gather intelligence with the help of the audience, then thirty minutes to make phone calls. Out of 67 objectives to achieve, Damien obtained 39 directly from his interlocutors. To gain credibility, he built the character of a union representative tasked with finalizing an internal survey on wage demands, after reading the local press for ten days.
He recounts that a supervisor, who had taken cybersecurity training three weeks earlier, typed an Internet address suggested during the call. His justification struck the author: “I typed it because it has my company’s name, otherwise I don’t type anything!” Damien points out that the presence of a company name in an address guarantees nothing.
The competition also included a measurement device: contestants were connected to a lie detector and a heart rate monitor during their calls. One contestant’s heart rate reached 155 beats per minute.
Second Place and a Lesson on Humans
Damien recalls a phrase from hacker Kevin Mitnick, heard during his visit to Lille: “You know, Damien, the hardest part isn’t talking to them, it’s hearing their breathing!”
During the three days of the competition, Damien called 43 people and called them all back to explain the context. He notes that a participant’s phrase, “Well, I’ll be darned, I got caught!”, sums up the experience. He believes awareness training should confront employees with realistic situations, as the real trap can start with a mundane conversation.
“In cyber intelligence, the most valuable intelligence is not always what a tool discovers. Sometimes it’s what a human agrees to share, without even understanding why they are being asked.”
