Dark web training: The Same Key

The Dark Web training in a 2:33 animated story. It covers What happens to stolen data; why password reuse matters. In English and Arabic, with captions you can switch on or off, and a scenario quiz at the end.

What your team will learn

Describe the four steps from a breach at another site to a break-in: another site is breached, the stolen logins are sold cheaply on the dark web, software tries them on other sites (credential stuffing), and a reused password opens those accounts.
State in plain words what the dark web is (a hidden part of the internet reached with special software, where stolen logins are sold), and leave searching it to the security team.
State why every account needs its own password, why work email and passwords stay for work, and why adding a number doesn't make a password new.
Respond correctly to a sign-in request you didn't start (deny it, report it, then change your password) and to a breach notice (open the site or app yourself, then change that password everywhere you used it).

The story

“The Same Key” is the story at the heart of this course. Layla (security analyst) is the lead character; the learner watches the situation unfold, spots the warning signs, and sees the right thing to do. Set in Nakhlora Group, a fictional Gulf company.

Sample quiz question

Layla's dashboard shows 300 sign-in attempts in 10 minutes on 120 Nakhlora accounts, and almost all of them fail. What is most likely happening?

Staff are mistyping their passwords after a system update.
Software is trying stolen passwords on many accounts at once.
The sign-in page is down, so colleagues keep trying again.
Colleagues are all signing in from home at the start of the day.

Correct answer: Software is trying stolen passwords on many accounts at once.

Why: Hundreds of tries in minutes, across many accounts, almost all failing: that is software working through a stolen list. It's called credential stuffing.

Full transcript

Transcript of the English video. The Arabic transcript is on the Arabic page.

The Same Key [0:01] Layla: Three hundred sign-in attempts in ten minutes. A hundred and twenty accounts. That's not people typing. That's software. [0:09] Narrator: Someone is trying stolen passwords on Nakhlora's sign-in page. Almost every one fails. Then one works. [0:18] Omar: Layla? My phone wants me to approve a sign-in. I'm not signing in. [0:24] Layla: Deny it. Someone has your password. Change it now. I'll sign you out everywhere. [0:30] Narrator: They'd get Omar's mail and every IT Support ticket: names, laptops, phone numbers. One old password got them this close. [0:40] Layla: Where else do you use that password? [0:44] Omar: The padel club app, and my personal email. It was just easier. [0:49] Layla: Padelwick was breached last year. Your work email and that password were in the stolen data. [0:56] Layla: Then the stolen list went on sale, here on the dark web. [1:01] Omar: It looks like any online shop. One point two million logins, for fifty-five dirhams? [1:08] Layla: It is one. Just on a hidden part of the internet, reached with special software. [1:14] Layla: Buyers load it into software that tries each login on hundreds of sites. That's credential stuffing, like this morning. [1:24] Narrator: Omar used one password in three places. One site leaked. How many accounts are at risk? [1:33] Layla: All three. You can't stop another site being breached. You can stop one leak opening every door. [1:40] Layla: Don't search the dark web yourself. We watch those lists for Nakhlora addresses. [1:46] Omar: Not that link. I'll open the app myself. [1:49] Layla: Then change it everywhere you used it, each one different. Adding a number doesn't make it new. [1:57] Narrator: A sign-in request you didn't start? Deny it, report it, then change your password. [2:03] Layla: The other hundred and nineteen stayed safe: their work passwords were different. But their work emails put Nakhlora on that list. [2:12] Karim: Work email for this? [2:14] Omar: Personal email, and its own password. [2:19] Narrator: Give every account its own password, and keep your work password for work. Anything odd? Report it, or contact your security team.

Key facts

Length (English)	2:33
Length (Arabic)	3:04
Languages	English · العربية
Captions	WebVTT
Quiz bank	14
Questions shown	10
Pass mark	80
Lead character	Layla — security analyst
LMS id	2047