How to start phishing

First, choose the country and language for your phishing email. Once those required fields are filled in, you can fine-tune things even more. Options include business function, gender, industry, seniority, or even specific software use. 

Adding more tags, and specifically business functions and industry, heightens the relevance of your mails to the target group which subsequently improves the potential phishing success. 

Moreover, mails with more tags selected will get prioritized by our algorithm over more generic mails .

Once you've locked in your tags, you're ready to start creating your phishing email. At the top of the page, you'll find placeholders. These will appear as the recipient's name, last name, organization, or even their colleagues when the email goes out. 

This way you can create a more personalised mail.

Senior colleague placeholders are, depending on the size of the company, the manager of the recipient or the CEO of the entire organisation. 

Peer colleagues are colleagues that the recipient works with on a daily basis.

Scrolling down, you’ll find the option to choose the email address. You’ll need to fill out a local part, which you can customize, and select a domain name from a provided list. 

Next, you can set the sender's display name, which your target will see in their email client alongside the email address. 

This is optional but typically increases phishing success.

After that, the most critical part is crafting a good subject line. This will determine whether your email gets opened. 

Here it is best to stay concise while also triggering curiosity.

A last option on this page is to add attachments to the email. This will only require specifying the attachment name; you don’t need to upload a file.

Continuing on, it's time for creating your phishing email, here you’ve got two options: go the coding route with HTML/CSS or use the built-in text editor.

Depending on the subject and the sender you choose for your simulation, you should make your choice in what layout you want for your mail.

To keep things safe for our clients, the creator comes with built-in safety checks. These automatically strip out any elements that could potentially harm the recipient, ensuring a secure phishing campaign. 

These elements are NOT allowed:

• Email addresses (use placeholders: {{firstname}}.{{lastname}}@{{organisation name}}.com)
• URL links (use link button or <a href=" ">)
• Javascript (or any other code than html/css)
• Video-call meeting links
• Topics related to our services (phishingtrainings, warnings, ...)
• IBAN-numbers
• Phone-numbers

• QR codes
  

Going for a html/css layout is a good way to mimic official communications from big corporations, online software, … 

To make a html based email, click “html” field next to “Sender”. 

Creating mails using the html editor can be slow sometimes, have some patience or use an external code editor such asVisual Studio Code.

Creating a simple text-based mail can be a great way to mimic HR announcements, communication between close colleagues and more. 

To make a text-based email, edit the field in the “craft my email” container.

Once you're happy with your phishing email, the next step is linking a landing page to your template.

You’ve got two options: design your own landing page to encourage data submissions (hello, more bounties!) or stick with the default tips page we provide.

If you’re creating your own, keep in mind that building landing pages takes some coding skills. That said, with the help of your go-to AI tool, even non-coders can whip up a decent one these days.

The key to an effective landing page is including a form that asks for sensitive information—think passwords, personal IDs, or similar data.

Templates with landingpages which do not ask for sensitive information will be declined.

When you’re done with the landing page, you are able to submit the email. The simulation will be marked as “Reviewing” and awaits an additional check. If we don’t find any issues, the email will get approved and sent out shortly.