The Varhugi curriculum

A walk-through of the fundamentals of online security, with everyday analogies and plain-language explanations of the technical terms. The rules that matter and habits you can start using today.

Version 1.1.0, updated 6 August 2026

Learn how to create strong passwords and why a password manager is the single most important security tool you can use.

Version 1.1.0, updated 25 August 2026

Learn why two-factor authentication is the most important security step after a password manager, how passkeys change the game, and where the weak spots remain.

Version 1.2.0, updated 15 August 2026

"Remind me later" is one of the most expensive buttons in the world. Learn why updates are direct defence against attacks, why "zero-day" gets so much airtime now, and why fake update popups are one of the most common ways malware gets onto your computer.

Version 1.1.0, updated 15 August 2026

One download, a "free" version, a fake update window or an ad at the top of the search results, can empty your browser in seconds: saved passwords, sessions, autofill and files. Here is how infostealers work, how they get in and which habits close the door.

Version 1.0.0, updated 4 October 2026

You clicked a phishing link, typed your password, or pasted confidential data into AI. The next hour matters most. Learn what to do.

Version 1.1.0, updated 6 August 2026

Wi-Fi at a cafe, airport, or hotel might be run by an attacker. Learn when it is dangerous and when it is not.

Version 1.1.0, updated 15 August 2026

Learn to spot Icelandic phishing emails and SMS, what to do when you're targeted, and how to report it.

Version 1.2.0, updated 4 October 2026

You click a link, see a familiar Microsoft or Google sign-in page, and type your password. Then a blank screen appears. This is one of the most common attacks today, and it is easy to defeat by reading the URL.

Version 1.1.0, updated 15 August 2026

The most common phishing attack in Iceland today doesn't arrive by email, it arrives by SMS. Learn how to spot it and what to do.

Version 1.1.0, updated 15 August 2026

QR codes became an everyday tool after covid, and attackers followed. Fake QR codes on parking meters, restaurants, meeting invites and emails route you to fraud pages. Learn how to inspect a code before you tap.

Version 1.1.0, updated 15 August 2026

An attachment is never just a document. PDFs carry links and fake sign-ins, Word and Excel ask you to "enable content", ZIP and ISO hide what the filters should have stopped, and HTML files build the attack inside your browser. Learn the patterns that matter and the one rule that covers them all.

Version 2.0.0, updated 2 October 2026

AI now writes flawless Icelandic phishing emails that the old advice, looking for typos, no longer catches. Learn how to react.

Version 1.1.0, updated 15 August 2026

A fake CAPTCHA page or error box tells you to press Win+R, paste something and hit Enter to prove you are human. What you paste is a command that fetches malware. No real website ever asks for this.

Version 1.0.0, updated 4 October 2026

Attackers impersonate your manager on WhatsApp, Slack, or Teams asking for a "quick favour". Learn how to recognise and stop the scam.

Version 1.1.0, updated 15 August 2026

The phone rings. It's "the bank", "IT support" or "the CEO", and they need one small thing, right now. Phone scams trade on the fact that a voice feels more trustworthy than text. But voices can be faked in minutes.

Version 1.3.0, updated 4 October 2026

Attackers impersonate vendors or executives and request transfers from finance. Learn how companies lose millions to a single email.

Version 1.1.0, updated 15 August 2026

The email comes from a real supplier, from the right address, inside a thread you have shared for months. Yet it is an attacker writing. When the supplier's account is taken over, "check the sender" and "check the domain" no longer settle it, so you need other signals and one firm rule.

Version 1.0.0, updated 4 October 2026

Training for anyone who talks to customers directly: service reps, call centres, reception, sales, and helpdesk. Five attack patterns that turn your helpfulness against the company: pretexting with public info, time pressure, manager impersonation, unexpected visits, and gradual information harvesting.

Version 1.1.0, updated 15 August 2026

Phishing, phone scams and a fake boss are different routes to the same goal. Beneath all of them lie the same levers in our heads: urgency, authority, fear, politeness and reciprocity. Once you recognise the feeling an attack produces, you recognise the attack, whichever channel it picks.

Version 1.0.0, updated 4 October 2026

An attack rarely starts with the first message. Preparation comes first: LinkedIn, the company website, social media and a few innocent questions on the phone. See how small pieces of information are assembled into a credible story and what you never owe a stranger.

Version 1.0.0, updated 4 October 2026

"I just used this little AI tool to summarise the meeting." Shadow IT is when employees use tools, apps or cloud services without IT approval. It's rarely malicious, yet it's one of the leading sources of data leaks.

Version 1.3.0, updated 4 October 2026

You paste a work document into ChatGPT to save time. Where does it end up? Who sees it? Learn how to use AI without leaking your company's secrets.

Version 1.2.0, updated 4 October 2026

AI answers with the same confidence whether it's right or wrong. Learn to spot the difference and protect yourself.

Version 1.1.0, updated 15 August 2026

AI hands you a command to run in the terminal. Stop before you press Enter. Learn why and how.

Version 1.1.0, updated 15 August 2026

You ask Copilot to summarise an email. The email contains hidden instructions telling Copilot to send data to an attacker. Learn how the attack works.

Version 1.1.0, updated 15 August 2026

An AI that may read your email, files and calendar can also act on them. Learn why permissions decide the damage, what third-party plugins and connectors mean, and how an AI's memory can be poisoned.

Version 1.0.0, updated 2 October 2026

AI is now part of our personal lives. Children use it, older relatives are targeted by deepfakes, and family photos end up in training datasets. Learn what to discuss at home.

Version 1.2.0, updated 4 October 2026

Attackers no longer try to bypass 2FA, they spam you with prompts until you approve one by accident. Learn to recognise and stop the attack.

Version 1.1.0, updated 15 August 2026

Multi-factor authentication does not stop everything. An attacker who gets hold of your session, the cookie your browser keeps after sign-in, needs neither your password nor a code. Here is how it works and how to defend yourself.

Version 1.0.0, updated 2 October 2026

You receive a short code in a message and are asked to enter it on the real Microsoft sign-in page. The domain is right and MFA is real, but the code signs the attacker's device into your account. Here is how it works and the one rule that stops it.

Version 1.0.0, updated 4 October 2026

The permissions dialog that asks whether an app may read your mail, files and calendar is one of the most dangerous pages you see at work. One click can give an attacker lasting access without stealing a password and without MFA stopping anything. Here is how to read the dialog and how to respond.

Version 1.0.0, updated 4 October 2026

The most physical of all security mistakes is leaving an unlocked computer or sensitive documents on your desk when you step away. Learn a two-second habit that prevents a huge share of insider data leaks.

Version 1.1.0, updated 15 August 2026

The laptop left in a taxi, the screen your seatmate reads and the door you hold open for a stranger. Away from the office, three everyday things decide most of what happens to work data.

Version 1.0.0, updated 2 October 2026

A dropped USB drive, a tampered airport charging station or an unknown Bluetooth device can compromise your computer in seconds. Learn why physical hardware is just as dangerous as malicious email.

Version 1.1.0, updated 15 August 2026

Corporate chat platforms look like a trusted environment, but they've become a top attack target. Fake coworkers, external guests in channels, and malicious attachments slip past spam filters simply because you trust chat more than email.

Version 1.2.0, updated 4 October 2026

You share a Google Doc or OneDrive file with "anyone with the link". Who can see it? Learn to share documents without leaking them to the internet.

Version 1.1.0, updated 6 August 2026

You clicked something you weren't sure about. Or got a strange phone call. Or plugged in a USB you found. Reporting it now is the difference between a technical issue and a costly legal crisis. Learn how, when and why.

Version 1.1.0, updated 15 August 2026

Three seconds of audio can be enough to create a convincing deepfake. Learn what the attack looks like and the simple defence that stops it.

Version 1.2.0, updated 2 October 2026

Ransomware is one of the most expensive classes of cyberattack. Whole companies are paralysed for weeks, hospitals divert patients, small businesses close for good. Learn how a single click can spiral into shutdown, and why backups are the strongest defence.

Version 1.1.0, updated 15 August 2026

Attack patterns targeting privileged accounts in AD and Entra (MFA fatigue, Kerberoasting, OAuth consent phishing, AD CS), and what to do in the first 60 minutes of a confirmed incident.

Version 1.1.0, updated 15 August 2026

Advanced module on third-party attack chains (SolarWinds, MOVEit, XZ-utils) and how to set up logs and alerts that catch real attacks before you lose.

Version 1.1.0, updated 15 August 2026

For service desks and IT teams who reset access for colleagues. The attacker calls as an employee, with the right names and a convincing story, and asks for an MFA reset, a new phone number or a new password. See what the attack looks like, which verification holds and why exceptions are exactly what the attacker is after.

Version 1.0.0, updated 4 October 2026