Separate authentication, app authorization, proposed tool actions and executed requests before attributing an incident.
Advanced OSINT practice starts when several plausible observations point in different directions. The task is not to invent the most dramatic explanation. It is to identify which records are independent, what their timestamps mean and what a proposed conclusion would require.
Contemporary context
FBI/IC3’s 1 September 2026 alert describes consent phishing through application permissions. That warning supplies context; the five linked dossiers use invented accounts and logs, not real incidents.
FBI/IC3 · 1 September 2026. Source checked on 6 October 2026. Public guidance is separate from the invented evidence in the exercises.
Five progressively harder investigations
Operation Consent Mirage: Authorization timeline and persistence
Build separate columns for authentication, consent, token use and revocation. A legitimate provider interface authenticates the platform, not the purpose or trustworthiness of every requesting app. Scope evidence bounds what access is demonstrated.
A fictional research team receives an event invitation followed by unusual mailbox activity. A successful login is being confused with approval of the requesting application. Reconstruct the timeline and identify the narrowest supported access mechanism. No links need to be opened.
Investigate the advanced dossier
Operation Build Shadow: Supply-chain lineage and byte identity
Trace commit, dependency, build, digest, signature, promotion and inventory separately. Verify the component that differs before treating a reproducible-looking filename or signature as a guarantee of equivalent behaviour.
A fictional build pipeline publishes two files named helper.zip. A vulnerability report treats matching names as matching releases. Determine which signed build actually reached production and where the lineage becomes undocumented.
Investigate the advanced dossier
Operation Prompt Spill: AI retrieval provenance and incident triage
Distinguish instruction origin, proposed action, approval and actual execution. A model’s natural-language claim is not an audit receipt; corroborate the destination and result through the authoritative action log.
A fictional support assistant retrieved a page that contained hostile instructions. The incident packet distinguishes a retrieved statement, an assistant response and a tool action. Assess what crossed the trust boundary without reproducing an attack.
Investigate the advanced dossier
Operation Proxy Chorus: Coordinated-source analysis and causal restraint
Count source dependencies before counting confirmations. Tool overlap can be a shared service, and a percentage without a denominator can mislead even when many downstream accounts repeat it.
A synthetic public poll has sudden posts repeating a claim. Measure independent source families and distinguish automation evidence from identity or intent. All accounts are fictional tokens.
Investigate the expert dossier
Operation Session Afterimage: Credential lifecycle and distributed clock uncertainty
Normalize clocks before applying a service guarantee. Investigate the specific credential identifier and class: password, browser session, refresh grant and API key can have different lifetimes and revocation controls.
A fictional incident report says an attacker stayed online after all credentials were revoked. Separate local time stamps, token classes and propagation delay. The lab’s revocation semantics are explicitly supplied.
Investigate the expert dossier
A reusable evidence worksheet
- Record the observation. Preserve the original wording, identifier, timestamp, source and uncertainty. A quoted claim is not the same as an independently verified event.
- Normalize without overwriting. Add a corrected time or comparable amount beside the original. Write the timezone, clock error, unit conversion and rounding rule so another analyst can reproduce it.
- Trace dependency. Identify copied reports, shared instruments and derived records. Several displays may still represent one originating observation.
- Test the competing explanation. Look for a control, alternative version, ordinary mechanism or missing authority that could produce the same visible result.
- State the boundary. Separate established observations, reasonable inferences and unresolved questions. Name the additional independent record most likely to change the assessment.
How these cases level up your practice
Each dossier contains eight synthetic evidence records and seven graded objectives. The first three investigations in this category are Advanced; the final two are Expert. Difficulty comes from multi-record reconciliation and calculation rather than hidden internet searches or obscure trivia. The brief states the necessary assumptions and answer format. You can keep a narrative analysis in your notes while the engine checks the decisive short answers.
Hints are progressive. Start with the structure hint, use the method hint if you need a way into the problem, and reserve the worked-resolution hint for learning after a genuine attempt. Final-answer reveals are a learning review and do not establish an unassisted investigation result. Published methods here explain the approach without reproducing the seven graded answers.
Frequently asked questions
Are these real incidents?
No. The records, identities, organisations and events are fictional. Where public current guidance is linked, it supplies a topic context rather than authentication of a dossier.
Do I need to contact or scan a real target?
No. The supplied packet contains the evidence needed for the objectives. Do not identify private people, access restricted systems or treat a tabletop route decision as real emergency guidance.
Can an unresolved conclusion be correct?
Yes. A sound investigation can establish a discrepancy while leaving identity, intent or cause unresolved. Report the supported result and the evidence required to go further.