Running A Successful Phishing Campaign

A phishing campaign is the the activity of an attacker attempting to social engineer one or more people for a common goal such as credential harvesting, endpoint compromise or invoking a response.

Why run a phishing campaign?

The most effective way to protect against phishing attacks is to simulate them. Running a simulated phishing campaign, provides you with a way of preparing your employees for a real-world attack. Phishing in it self is a broad term, there are many different types of phishing attacks, such as email phishing, voice phishing (vishing), SMS phishing (smishing), malicious advertising (malvertising) and so on.

The most common form of phishing used to compromise businesses today is email phishing, in-fact 90% of data breaches are the result of human error. When running a simulated phishing campaign, we need to utilise the same techniques used by threat actors to properly simulate them. These techniques include:

The stages of a successful phishing campaign

Running phishing campaigns can be complex without the right approach. Remember, we're attempting to trick not only our employees but also our defensive tooling. To run a successful simulated phishing campaign we need to ensure allow listing has been configured on any email or web filters in-use. Once allow listed, we can proceed with actually executing the campaign. Typically campaigns can be broken into 3 distinct phases.

1. Campaign Setup

  • Target Selection - Multiple targets in a single phishing campaign should have a common attribute. This could be the company they work for, the division they work within or the type of role they have.
  • Phishing Material Selection - Content should be highly relevant and personalised. The more convincing and relatable the phish, the more likely the target is to interact with it.
  • Campaign Scheduling – Campaigns should be scheduled during the business hours the targets are working. Additionally, depending on the number of targets, email delivery should be staggered over one or more days.
  • Campaign Execution – To ensure campaign success, we need to ensure that targets can receive our emails. It's advisable to run a series of tests prior to final delivery.
Phishing Material Selection

2. Campaign Management

Once a campaign has been scheduled and delivery is underway we need to ensure our phishing infrastructure is maintained and ready. This includes both the mail server delivering phishing emails and the web server hosting any phishing websites.

If you're using a managed phishing solution such as CanIPhish, this is taken care of for you. If you're using an open-source or self-hosted tool such as GoPhish then the responsibility for maintaining this infrastructure is on you.

If users report phishing material, your infrastructure may stop functioning prior to campaign completion. For this reason, you need to monitor infrastructure for during a campaign.

Campaign Management

3. Campaign Reporting

To understand what portion of the business is vulnerable to phishing attacks we need to closely monitor phish click and report metrics. Trackable metrics include:

  • Email Delivered - Did the email end up the targets inbox or was it bounced/rejected?
  • Email Viewed - Did the target view the email? Was the email subject or sender name engaging enough?
  • Payload Clicked - Did the target click on any links or download any attachments?
  • Target Compromised – Did the target enter their credentials into a phishing website or execute a file on their computer?
  • Phish Reported – Did the target report the suspected phishing email?
CanIPhish Reporting Page

Free Phishing Campaign Tools

CanIPhish maintain a variety of free tools that allow you to easily run free simulated phishing campaigns at no cost!

Stacked Emails

Sender Spoofing

Discover domains vulnerable to email domain spoofing and incorporate these into your simulated phishing training campaigns.

Document appearing out of screen

Hosted Training Website

When your employees fall for a simulated phishing campaign, they'll be directed to the CanIPhish learning page, or one that you configure.

Layered Documents

Comprehensive Support

Get the most out of CanIPhish with our comprehensive knowledge base, live chat, phone and email support.

Pencil and ruler

Directory Integrations

Upload employees via CSV or automate directory synchronisation with our Azure AD and Google Workspace integrations.

Cloud storage

Flexible Infrastructure

Our highly dynamic platform enables you to use our hosted mail and web servers or to bring your own.

Opening box

A full solution for everyone

Whether you’re an enterprise looking to train users, a red teamer conducting a penetration test; or a hobbyist, we have you covered.