Design and Development of Anti-Phishing AG: A Web-Based 3D Serious Game to Improve Phishing Awareness Among Students in Saudi Arabia

Shahad Alzahrani; Sahar Badri; Farrukh Nadeem

doi:10.48084/etasr.18035

Authors

Shahad Alzahrani Department of Information Systems, Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah, Saudi Arabia
Sahar Badri Department of Information Systems, Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah, Saudi Arabia
Farrukh Nadeem Department of Information Systems, Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah, Saudi Arabia

Volume: 16 | Issue: 3 | Pages: 35270-35280 | June 2026 | https://doi.org/10.48084/etasr.18035

Received: 7 February 2026 | Revised: 26 March 2026 | Accepted: 3 April 2026 | Online: 13 April 2026

Corresponding author: Shahad Alzahrani

Abstract

Phishing remains one of the most prevalent social-engineering threats, targeting users' decision-making to obtain sensitive information. To effectively counter such threats, students must be well informed about how phishing attacks work, including the methods and strategies used. However, phishing awareness training is not consistently embedded in school curricula, and when available, it is often delivered through limited, non-interactive sessions. This study presents Anti-Phishing AG, a web-based 3D serious game designed to improve students' ability to recognize and respond to phishing attempts through interactive scenarios and immediate feedback. The game is developed based on a novel assessment and training framework grounded in prior empirical research and aligned with the Saudi National Cybersecurity Authority (NCA) standards and guidance. The study outlines the design of the novel Anti-Phishing AG framework, the development process of the web-based 3D game, and the development and validation of an accompanying survey instrument to measure awareness and learning outcomes. The game is evaluated using a one-group pre-test/post-test design with 702 students from middle and high schools. The findings of this study highlight the value of interactive serious games and tailored educational tools in raising cybersecurity awareness. The study provides a reusable foundation for similar awareness tools. It supports national goals by contributing to cybersecurity education in Saudi society, aligning with one of the key objectives of Vision 2030.

Keywords:

phishing awareness, serious game, web-based 3D game, cybersecurity education, assessment framework, Saudi Arabia, Anti-Phishing AG

Downloads

Download data is not yet available.

References

S. Das, C. Nippert-Eng, and L. J. Camp, "Evaluating User Susceptibility to Phishing Attacks," Information & Computer Security, vol. 30, no. 1, pp. 1–18, Jan. 2022.

"What Is Phishing?," Cisco, 2025. https://www.cisco.com/site/us/en/learn/topics/security/what-is-phishing.html.

M. F. Ansari, P. K. Sharma, and B. Dash, "Prevention of Phishing Attacks Using AI-Based Cybersecurity Awareness Training," International Journal of Smart Sensor and Adhoc Network., pp. 61–72, Mar. 2022.

"Financial Cyberthreats Targeting Businesses in Saudi Arabia Drop by 24% in Q2 of 2022," Kaspersky, Oct. 2022. https://me-en.kaspersky.com/about/press-releases/financial-cyberthreats-targeting-businesses-in-saudi-arabia-drop-by-24-in-q2-of-2022.

"Phishing Activity Trends Reports: 1Q-2025," Anti-Phishing Working Group, Mar. 2025. https://apwg.org/trendsreports.

A. Darem, "Anti-Phishing Awareness Delivery Methods," Engineering, Technology & Applied Science Research, vol. 11, no. 6, pp. 7944–7949, Dec. 2021.

G. Alotibi, "A Cybersecurity Awareness Model for the Protection of Saudi Students from Social Media Attacks," Engineering, Technology & Applied Science Research, vol. 14, no. 2, pp. 13787–13795, Apr. 2024.

T. Alharbi and A. Tassaddiq, "Assessment of Cybersecurity Awareness among Students of Majmaah University," Big Data and Cognitive Computing, vol. 5, no. 2, May 2021, Art. no. 23.

D. A. S. Wibawa, H. Setiawan, and Girinoto, "Anti-Phishing Game Framework Based on Extended Design Play Experience (DPE) Framework as an Educational Media," in 2022 7th International Workshop on Big Data and Information Security, Depok, Indonesia, Oct. 2022, pp. 107–112.

S. Sheng et al., "Anti-Phishing Phil: The Design and Evaluation of a Game That Teaches People Not to Fall for Phish," in Proceedings of the 3rd Symposium on Usable Privacy and Security, Pittsburgh, PA, USA, Jul. 2007, pp. 88–99.

L. Kassner and A. Schönbohm, "A Serious Game to Improve Phishing Awareness," in Games and Learning Alliance, vol. 13647, K. Kiili, K. Antti, F. De Rosa, M. Dindar, M. Kickmeier-Rust, and F. Bellotti, Eds. Cham, Switzerland: Springer International Publishing, 2022, pp. 109–117.

A. Baiomy, M. Mostafa, and A. Youssif, "Anti-Phishing Game Framework to Educate Arabic Users: Avoidance of URLs Phishing Attacks," Indian Journal of Science and Technology, vol. 12, no. 44, pp. 01–10, Nov. 2019.

J. Kävrestad, A. Hagberg, M. Nohlberg, J. Rambusch, R. Roos, and S. Furnell, "Evaluation of Contextual and Game-Based Training for Phishing Detection," Future Internet, vol. 14, no. 4, Mar. 2022, Art. no. 104.

R. C. T. Panga, J. Marwa, and J. D. Ndibwile, "A Game or Notes? The Use of a Customized Mobile Game to Improve Teenagers’ Phishing Knowledge, Case of Tanzania," Journal of Cybersecurity and Privacy, vol. 2, no. 3, pp. 466–489, Jun. 2022.

A. Yasin, R. Fatima, Z. JiangBin, W. Afzal, and S. Raza, "Can Serious Gaming Tactics Bolster Spear-Phishing and Phishing Resilience?: Securing the human hacking in Information Security," Information and Software Technology, vol. 170, Jun. 2024, Art. no. 107426.

A. Rahartomo, A. T. A. Ghaleb, and M. Ghafari, "Phishing Awareness via Game-Based Learning," in 37th International Conference on Software Engineering Education and Training, Ottawa, ON, Canada, Apr. 2025, pp. 287–291.

A. Yasin, R. Fatima, L. Wen, Z. JiangBin, and M. Niazi, "What Goes Wrong During Phishing Education? A Probe into a Game-Based Assessment with Unfavourable Results," Entertainment Computing, vol. 52, Jan. 2025, Art. no. 100815.

W. Yeoh, H. Huang, W.-S. Lee, F. Al Jafari, and R. Mansson, "Simulated Phishing Attack and Embedded Training Campaign," Journal of Computer Information Systems, vol. 62, no. 4, pp. 802–821, Jul. 2022.

P. Weanquoi, J. Johnson, and J. Zhang, "Using a Game to Improve Phishing Awareness," Journal of Cybersecurity Education, Research and Practice, vol. 2018, no. 2, Dec. 2018.

Z. A. Wen, Z. Lin, R. Chen, and E. Andersen, "What Hack: Engaging Anti-Phishing Training Through a Role-Playing Phishing Simulation Game," in Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems, Glasgow, Scotland, UK, May 2019, pp. 1–12.

R. Fatima, A. Yasin, L. Liu, and J. Wang, "How Persuasive is a Phishing Email? A Phishing Game for Phishing Awareness," Journal of Computer Security, vol. 27, no. 6, pp. 581–612, Oct. 2019.

S. Yang and G. Berdine, "Normality Tests," The Southwest Respiratory and Critical Care Chronicles, vol. 9, no. 37, pp. 87–90, Jan. 2021.

"Wilcoxon Signed-Rank Test using SPSS Statistics," Laerd Statistics, 2025. https://statistics.laerd.com/spss-tutorials/wilcoxon-signed-rank-test-using-spss-statistics.php.

"Regulations Documents," National Cybersecurity Authority, 2025. https://nca.gov.sa/en/regulatory-documents/.

"Saudi Banks-Be Careful," Saudibanks, Jan. 2025. https://saudibanks.com.sa/en/becareful.

S. S. Tirumala, A. Sarrafzadeh, and P. Pang, "A Survey on Internet Usage and Cybersecurity Awareness in Students," in 14th Annual Conference on Privacy, Security and Trust, Auckland, New Zealand, Dec. 2016, pp. 223–228.

E. J. Williams and A. N. Joinson, "Developing a Measure of Information Seeking About Phishing," Journal of Cybersecurity, vol. 6, no. 1, Jan. 2020, Art. no. tyaa001.

"What Is Unreal Engine?," Bairesdev, Oct. 2022. https://www.bairesdev.com/blog/what-is-unreal-engine/.

S. Alzahrani, "Anti Phishing AG Public." GitHub, Mar. 2025, [Online]. Available: https://github.com/salzahrani-coder/AntiPhishing_AG.