conducting-spearphishing-simulation-campaign

Follow the five-phase workflow: develop OSINT-based pretexts, build and test payloads against the target's security stack, set up infrastructure with aged domains and valid SPF/DKIM/DMARC, execute in waves rather than mass sends, then analyze delivery, click, and credential submission metrics.

GoPhish handles campaign management and tracking, Evilginx2 performs real-time credential harvesting with MFA session capture, and King Phisher, SET, Modlishka, CredSniper, and Fierce Phish cover additional phishing and social engineering vectors. All listed tools are open source.

Missing or incorrect SPF, DKIM, and DMARC alignment is the most common cause, along with freshly registered look-alike domains that lack reputation. Age domains for at least two weeks, submit them for categorization, and verify all three authentication checks pass before the first wave.

The skill maps to T1566.001 (Spearphishing Attachment), T1566.002 (Spearphishing Link), T1566.003 (Spearphishing via Service), T1598.003 (Phishing for Information), T1204.001/T1204.002 (User Execution), and infrastructure techniques T1583.001 and T1585.002.

Spearphishing simulation is legal only with explicit written authorization from the target organization, such as under a signed red team engagement scope. Unauthorized use against systems you do not own or have permission to test violates computer fraud laws.

Open tracking is noisy because security scanners and email gateways pre-click links and load tracking pixels. The reliable success signals are credential submissions captured in GoPhish or Evilginx2, session cookie capture, or a payload beacon checking in from a target host.