A journalist secured second place in the Social Engineering CTF at Hackfest de Québec after three days of open-source intelligence gathering and telephone manipulation exercises. Twenty competitors targeted 28 organizations including Decathlon, Ikea, Air Canada and Home Depot, answering approximately one hundred questions that ranged from pest-control contracts to waste-collection schedules and the continued use of Flash content.
One Week of Research, Thirty Minutes on the Phone
The competition began with a week-long reconnaissance phase worth half the total score. The participant deliberately avoided commercial OSINT platforms and instead cross-referenced videos, audio recordings and public professional posts to verify each answer. Roughly 95 percent of the dossier was completed before any calls were placed.
Call windows were randomly assigned, and the journalist drew the lunch-break slot, forcing rapid adaptation to employees with limited time. Despite language shifts between English, Quebec French and standard French, enough information was obtained to advance to the semi-finals and final.
Five Custom Tools for Real-Time Conversations
Five bespoke tools were created to support live calls. The first was an intelligent directory that mapped phone numbers to roles and services, enabling instant rebound options when a primary contact was unavailable. A second tool generated realistic background audio such as crying infants or fire alarms to shape the listener’s perception of urgency or distraction.
A third, privately developed AI engine retrieved previously verified open-source context to counter objections such as “I do not know you.” All data remained sourced exclusively from public records; the system did not generate fabricated responses. The remaining two tools were demonstrated only during closed workshops.
Final-Round Persona Shift and 39 Direct Answers
In the final, the journalist abandoned standard IT-support pretexts and instead posed as a union representative finalizing an internal salary survey timed to coincide with real wage negotiations reported in the Journal de Québec, Journal de Montréal and Les Affaires. Local political and economic context gathered over ten days of reading allowed natural references that retained employee attention.
With only twenty minutes of on-site preparation aided by spectators, the competitor obtained 39 of 67 objectives directly from employees, including details on VPN usage, intranet access and remote-work configurations. One supervisor who had completed cybersecurity training three weeks earlier still entered a supplied URL after noting the company name in the address.
The result underscored that even recent awareness training can fail when an attacker leverages accurate, publicly available context rather than technical exploits.
