Phishing Simulation & Security Awareness — Operation: HOOK, LINE & SINKER

⚖️ MANDATORY LEGAL BRIEFING — Read This Before Lab 0.1

Phishing simulation is the only topic in this workbook series where the exact same actions — sending a deceptive email designed to steal credentials — are either a legitimate security service or a federal crime, depending entirely on one thing: written authorization from the account owner. There is no grey area. Every student must understand this before touching GoPhish.

1.Written authorization is non-negotiable — every single time. A verbal "go ahead," a previous engagement, or a general employment mandate does not count. Get a signed statement of work or engagement letter naming the specific scope before sending a single simulation email. In real engagements, this protects you legally if the client later claims they didn't authorize the test.
2.In this classroom, all targets are consenting participants. Every lab in this workbook sends simulation emails only to email addresses you personally own, to Mailtrap's sandbox (where nothing is delivered), or to classmates who have explicitly consented in writing. Never enter a colleague's or stranger's email address as a target — that constitutes an unauthorized phishing attack regardless of your intention.
3.Scope boundaries are hard limits. If a real engagement covers employees of Hartley Financial, it does not cover their customers, partners, or vendors — even if those third parties use Hartley-branded email. Document the exact list of in-scope addresses and get it approved. Anything not on the list is out of scope.
4.No malware, no real credential harvesting beyond a fake login page. Simulation means proving someone would have clicked, not actually compromising their account. GoPhish's tracked landing page proves the click — there's no reason to do more.
5.Data handling rules apply to simulation results. Click rates, submitted credentials (even fake ones from a landing page), and individual results are sensitive HR data. Treat them with the same controls as the incident they're simulating — encrypted at rest, access-controlled, retention-limited.
6.Relevant law includes: UK Computer Misuse Act 1990 (unauthorized access), Fraud Act 2006, GDPR (employee data from results), Nigeria Cybercrime Act 2015 (Section 22 — phishing), Nigeria Data Protection Act 2023 — and equivalent statutes in any jurisdiction where targets are located. Ignorance of which law applies is not a defence.

This workbook is training guidance only, not legal advice. Laws vary by country, organisation type, and employment context. Before running any phishing simulation in a real engagement, obtain written authorization and, where required by your jurisdiction, consult legal counsel.

🧭

Module 0 – Orientation & Engagement Planning

3 labs · The phishing attack taxonomy, the engagement lifecycle, and how Hartley's BEC incident maps to it

0.1

The Phishing Attack TaxonomyTypes, terminology, and how they differ in impact and sophistication

▾

ObjectiveUnderstand every category of phishing attack — what distinguishes them, which ones a financial services firm faces most, and which you'll simulate in this workbook.

The Phishing Family

Type	Target	Typical Pretext	Risk To Hartley
Phishing	Mass, untargeted	Account suspended, package delivery, prize	Low per-employee — high volume
Spear Phishing	Named individual, researched	References real project, colleague, or vendor	High — finance and HR staff most targeted
Whaling	C-suite specifically	Board-level urgency, M&A, regulatory	Extreme — BEC at executive level
BEC	Finance/AP/payroll	Impersonates CEO or CFO requesting urgent wire	Critical — Hartley's actual incident was this
Vishing	Any employee by phone	IT support, bank fraud team, government	High but out of scope for GoPhish
Smishing	Mobile numbers	Package, bank alert, HR link	Medium — requires separate tooling
Credential Harvest	Any with email access	Office 365 / Google login page clone	High — single-factor accounts targeted first

This workbook focuses on email-based phishing, spear phishing, and BEC simulation — the categories GoPhish is built for, and the ones directly responsible for Hartley's incident.

🎣

Hartley context: The BEC that triggered this engagement used a spoofed CEO email asking the AP team to wire $47,000 to a "new vendor" before month-end. Two employees complied. The CISO doesn't know how many more would have. Your simulation will find out.

0.2

The Full Simulation Engagement LifecycleScoping · authorization · execution · training · re-test

▾

ObjectiveUnderstand the complete arc of a professional phishing simulation engagement — every step from initial scoping call to the re-test that proves the training worked.

The Seven Phases

Scoping & Authorization
Define the target list, email addresses in scope, allowed pretext categories (must exclude topics that could cause genuine distress — job loss, health emergencies), go/no-go criteria, and who gets told. Get everything in writing before touching any tool.
Intelligence & Pretexting
Research the target organization, identify believable pretexts using open-source intelligence, and design the campaign narrative. The quality of this phase determines click-through rate more than any technical factor.
Infrastructure Build
GoPhish setup, SMTP configuration, domain and landing page, tracking — everything that makes the campaign look real without actually being malicious.
Template Craft
Write the email and build the landing page. Subject line, sender display name, body copy, urgency/authority triggers — and always an "out" that lands on a training page rather than a dead link.
Campaign Execution
Launch, monitor in real time, respond to HR escalations (some employees will report the email — that's the right behaviour, reward it), and manage edge cases.
Results Analysis & Reporting
Click rates, submission rates, report rates, department breakdown, time-to-click — and a written report the CISO can present to the board.
Training & Re-test
Deliver awareness training targeted at exactly what employees clicked on, set a re-test date, and measure the delta. A simulation without training is just embarrassing people — this phase is where the engagement has real security value.

📋

Phases 1–6 without Phase 7 is an incomplete engagement. The click-rate data is only valuable as a baseline — what matters is whether it's lower three months later after training. Always set the re-test date before delivering the Phase 6 report.

0.3

Drafting The Engagement Authorization DocumentThe one document that separates simulation from crime

▾

ObjectiveDraft a complete authorization document for the Hartley engagement — the same document your instructor will sign before any lab email is sent in this classroom.

Required Elements

Element	What It Must Say
Authorizing party	Full name, title, and signature of someone with actual authority to authorize the test
Scope — in	Exact email domains or addresses in scope — named explicitly, not "all employees"
Scope — out	Explicitly excluded groups (executives? customers? recently bereaved staff?)
Pretext restrictions	Topics prohibited — job offers/redundancy, health, family emergencies, anything that could cause genuine distress
Engagement window	Exact start/end dates and hours — outside this window, nothing sends
Escalation contact	Who to call if an employee reports distress — a named HR contact, not just "HR"
Data handling	Who can see individual results, retention period, and how results will be destroyed
Awareness-positive clause	Explicit statement that employees who correctly report the simulation will be praised, not disciplined

Classroom Step

Draft the Hartley authorization document. Your instructor reviews and signs it — or rejects it with feedback. No lab email sends until this is done. That's not bureaucracy; that's how real engagements work.

⚖️

The awareness-positive clause is not optional. Naming and shaming employees who click is counterproductive, legally risky in many jurisdictions, and directly contradicts the purpose of the engagement. It belongs in writing, in the authorization document, before the campaign launches.

⚙️

Module 1 – Infrastructure Setup

3 labs · GoPhish on Kali, SMTP configuration, and why email authentication matters for deliverability

1.1

Installing & Configuring GoPhish on Kali Linuxapt install · gophish-start · admin panel · API key · first login

▾

ObjectiveInstall GoPhish, start the service, log in, change the default password, and explore the dashboard before connecting any SMTP or target data.GoPhishKali

⚠️

On Kali Linux, the gophish command is deprecated. Always use gophish-start to start the service and gophish-stop to stop it. The Kali-packaged default credentials are admin / kali-gophish — not the upstream default.

Step-By-Step

Install GoPhish from Kali's repository
GoPhish is in Kali's official package repository — no manual download needed.
Start the GoPhish service
Using Kali's wrapper command.
Open the admin panel
In your browser at https://127.0.0.1:3333 — accept the self-signed certificate warning.
Log in and immediately change the password
Using the Kali default credentials, then set a strong passphrase you'll use for this lab.
Save your API key
From the account settings page — you'll need it for Module 5's campaign management.
Explore the five main sections
Dashboard, Campaigns, Users & Groups, Email Templates, Landing Pages, Sending Profiles.

# install GoPhish from Kali's official repository
sudo apt update && sudo apt install gophish -y

# start the GoPhish service using Kali's wrapper
gophish-start

# the dashboard is at:
https://127.0.0.1:3333

# default Kali credentials (change immediately on first login)
# Username: admin
# Password: kali-gophish

# stop when finished
gophish-stop

Check	Expected Result
gophish-start	Service starts without errors, shows listener address
Browser at :3333	GoPhish login page loads (accept self-signed cert)
Login with admin/kali-gophish	Dashboard visible — change password immediately
Account settings	API key visible and copyable

💡

GoPhish's admin panel only listens on localhost (127.0.0.1) by default. This is correct for a training lab — it means the admin interface is never exposed to the network. Only the phishing listener needs to be reachable by targets, and in this classroom lab, that stays on localhost too since we're using Mailtrap's sandbox.

1.2

Configuring SMTP with Mailtrap SandboxA safe relay that captures without delivering — mandatory for classroom use

▾

ObjectiveConnect GoPhish to Mailtrap's email sandbox so simulation emails are captured and inspected without ever being delivered to real inboxes.SMTPGoPhish

⚖️

Classroom rule: All lab emails in this workbook route through Mailtrap's sandbox. This means zero real emails are delivered — you can see and inspect everything in Mailtrap's dashboard, but nothing reaches an actual inbox. This is non-negotiable for classroom use. Do not substitute a real SMTP relay unless you have explicit authorization for real delivery and your instructor confirms it.

Step-By-Step

Create a free Mailtrap account
At mailtrap.io — the free tier provides a sandbox inbox that captures emails without delivering them.
Get your sandbox SMTP credentials
In Mailtrap, open Email Testing → Inboxes → your inbox → SMTP Settings tab. Note the Host, Port, Username, and Password.
Create a Sending Profile in GoPhish
Navigate to Sending Profiles → New Profile. Fill in the fields using your Mailtrap credentials.
Send a test email
Use GoPhish's "Send Test Email" button and verify it appears in your Mailtrap inbox.
Inspect the test email
In Mailtrap, open the email and look at: Raw source (headers), HTML body, Spam Score, and Tech Info. You'll read all of these analytically in Module 2.

# Mailtrap sandbox SMTP settings (replace with your actual credentials)
Host     : sandbox.smtp.mailtrap.io
Port     : 2525  # or 587 — both work in the sandbox
Username : <your-mailtrap-username>
Password : <your-mailtrap-password>

# GoPhish Sending Profile fields:
# Name     : Hartley IT - Sandbox
# From     : IT Helpdesk <helpdesk@hartley-financial.com>
# Host     : sandbox.smtp.mailtrap.io:2525
# Username : (your Mailtrap sandbox username)
# Password : (your Mailtrap sandbox password)

Check	Expected Result
Test email sent from GoPhish	Appears in Mailtrap inbox within seconds
Mailtrap Raw source	Shows GoPhish headers including X-Mailer and X-Gophish-Contact
Mailtrap Spam Score	Will likely be moderate — note this, you'll improve it in Lab 1.3
Real inbox delivery?	Zero — Mailtrap sandbox never delivers to real addresses

1.3

Email Authentication — SPF, DKIM & DMARCWhat they do, how they affect deliverability, and why real attackers care about them

▾

ObjectiveUnderstand the three email authentication standards that determine whether a simulation email looks legitimate — and why attackers spend as much effort on these as on the pretext itself.

The Three Standards

Standard	What It Does	What Fails Without It
SPF (Sender Policy Framework)	DNS record listing which servers may send email for your domain	Receiving server marks email suspicious or rejects it outright
DKIM (DomainKeys Identified Mail)	Cryptographic signature proving the email wasn't modified in transit	Spam filters score it higher; some filters require it
DMARC (Domain-based Message Auth)	Policy telling receivers what to do when SPF or DKIM fail — and where to send reports	No enforcement of SPF/DKIM failures — spoofing succeeds silently

Step-By-Step

Look up Hartley's (simulated) domain SPF record
Use MXToolbox to query SPF for a domain — observe what a well-configured and poorly-configured record look like.
Check DMARC policy for the same domain
A p=reject DMARC policy means spoofed emails claiming to be from that domain will be rejected. A p=none means spoofing succeeds silently while DMARC reports are sent.
Inspect your Mailtrap test email's authentication headers
Open the Raw source from Lab 1.2. Find the Authentication-Results header — what passed and what failed?
Understand the attacker's perspective
Real phishing actors register lookalike domains (hartley-financial.com vs hartleyfinancial.com) and set up SPF/DKIM/DMARC on those — making the email appear authenticated even though it's spoofed.

# check SPF record for any domain
dig TXT hartley-financial.com | grep spf

# check DMARC policy
dig TXT _dmarc.hartley-financial.com

# example DMARC policy values and their meaning
# p=none   → monitor only, no enforcement (spoofing succeeds)
# p=quarantine → send suspicious emails to spam
# p=reject  → reject spoofed emails outright (strongest protection)

Authentication Result	Implication
spf=pass, dkim=pass, dmarc=pass	Email appears fully authenticated — highest deliverability, lowest spam score
spf=fail, dmarc=none	Spoofing visible to receiving server but no enforcement — may land in spam
dmarc=reject	Spoofed email claiming to be from this domain will be rejected — best protection for the domain being spoofed

📋

Mailtrap's sandbox skips real-world authentication checks deliberately — that's why it's safe for training. In a real engagement against a real organization, the deliverability of your simulation email depends heavily on whether you're sending from a properly authenticated domain. Always use a domain you own and have set up SPF/DKIM/DMARC for.

🔭

Module 2 – Target Intelligence & Pretexting

2 labs · Open-source research that makes a phishing email convincing, and the cognitive triggers that make people click

2.1

OSINT Reconnaissance for Phishing CampaignsLinkedIn · company website · email format discovery · public org chart

▾

ObjectiveGather the open-source intelligence a real attacker would use to make a phishing email feel like it came from inside — practiced against a fictional organization only.OSINT

⚖️

This lab is practiced against the fictional Hartley Financial Services or against your own organization with explicit permission. Never run OSINT collection against a real company you haven't been authorized to assess — even passive research can cross legal lines depending on how you use and store the data.

Step-By-Step — OSINT Research

Map the email format
From LinkedIn profiles, GitHub commits, or leaked breach data on haveibeenpwned.com (domain search). Common formats: firstname.lastname@, f.lastname@, firstname@. One confirmed email tells you the pattern for all of them.
Identify department heads and reporting lines
LinkedIn's "People" section for the company gives you org structure, job titles, tenures. Who does AP report to? Who recently joined? Who signs off on vendors?
Find recent events and internal announcements
Press releases, job postings (reveal internal projects), Glassdoor reviews (reveal systems and tools in use), and the company's own news page. A simulation referencing a real-named project or system hits harder than a generic one.
Identify tools and systems in use
Job postings often name the exact internal systems — "experience with ServiceNow," "Office 365 environment." A phishing email referencing the real help desk tool is far more convincing than a generic IT email.
Document your findings in a target profile
For the Hartley scenario: email format, key personnel (CEO, CFO, AP manager), recent events (merger), internal systems, and vendors known to them.

Intelligence Type	Source	How It's Used In The Pretext
Email format	LinkedIn, public GitHub commits, breached data sites	Makes the from/reply-to look exactly right
Reporting lines	LinkedIn company page → People	CEO impersonation works only if you know who reports to the CEO
Recent events	Press releases, news, job postings	"Following our recent merger" feels real when the merger is real
Internal systems	Job postings, Glassdoor, help desk subdomains	Reference the real tool name (ServiceNow, Workday) not a generic one
Known vendors	LinkedIn posts, case studies, news	BEC impersonating a vendor the target actually uses is far more convincing

2.2

The Psychology of PretextingCialdini's principles · urgency · authority · scarcity · designing a campaign narrative

▾

ObjectiveUnderstand the psychological triggers that make phishing work — and design a campaign narrative for Hartley that uses them ethically in a simulation.

The Six Triggers (Cialdini's Principles in Phishing)

Trigger	How Phishing Uses It	Simulation Example
Authority	Email appears to come from a senior person, brand, or regulator	CEO requesting urgent wire transfer; HMRC / FCA notice
Urgency	Time pressure reduces critical thinking	"Respond before COB today," "your access expires in 24 hours"
Scarcity	Limited availability creates fear of missing out	"Only two slots remain for the compliance training"
Social Proof	Others are doing it — reduces friction	"All staff in your department have completed this already"
Liking	Impersonate someone the target knows and trusts	Email appearing to come from a named colleague or vendor
Reciprocity	Offer something first, then make a request	Fake HR benefits portal, fake IT support resolving an issue

Step-By-Step — Design the Hartley Campaign Narrative

Choose a pretext scenario
That fits your OSINT from Lab 2.1. The best pretext uses real details (real system name, real event, real sender name). Choose from: IT password reset, DocuSign document pending, HR benefits update, invoice approval, or a merger-related announcement — all appropriate for a financial services firm, none likely to cause genuine distress.
Identify which triggers your scenario uses
List them explicitly. Authority? Urgency? Both?
Write the one-sentence campaign brief
Example: "An email appearing to come from the Hartley IT team claims the recipient's Microsoft 365 password expires in 24 hours and directs them to a login page to reset it — targeting authority (IT), urgency (24 hours), and a familiar process (password reset)."
Define the success metric
Click-through to the landing page? Credential submission? Both? Be specific before you build.

🎣

Recommended scenario for classroom labs: "IT Security: Your Microsoft 365 password expires in 24 hours" — uses authority (IT Security team), urgency (24-hour deadline), and a familiar, low-distress process (password reset). This is one of the highest-performing pretexts in real engagements and it's non-distressing, non-financial, and easy to defend in a post-simulation debrief.

✉️

Module 3 – Phishing Email Templates

3 labs · Subject line science, HTML template craft, and three complete scenario templates built in GoPhish

3.1

The Anatomy of a Convincing Phishing EmailSubject lines · sender display names · body copy · red flags to deliberately avoid

▾

ObjectiveUnderstand each component of a phishing email and how it contributes to or undermines believability — then apply these principles to every template you build.

Component Breakdown

Component	What Makes It Convincing	Common Mistakes That Expose It
From display name	Matches the real sender's name exactly; uses the correct title	Generic "IT Support" or "Admin" with no company name
From email address	Uses a domain that looks right — ideally the real domain via a sending profile, or a visually similar one	Obvious lookalike: hartley-financial.co vs hartley-financial.com
Subject line	Specific, action-oriented, references something real or plausible; 6–10 words	ALL CAPS URGENT or excessive punctuation!!!
Greeting	Uses the recipient's real first name via GoPhish's `{{.FirstName}}` tag	"Dear Valued Employee" or "Hello User"
Body copy	Concise, professional tone matching the sender persona; references real tools/processes; one clear call to action	Wall of text; grammar errors; inconsistent formatting; multiple CTAs
Call to action	One button or link with a specific, believable label: "Reset My Password" not "Click Here"	Bare URLs; "Click Here" with no context
Signature	Matches the sender's real signature format if known; includes a real phone number and address	No signature, or a signature that doesn't match the sender persona
GoPhish tracking	`{{.Tracker}}` tag in the HTML for open tracking; `{{.URL}}` in the CTA link	Missing tracking tags means no click data in the dashboard

GoPhish Template Variables

{{.FirstName}}      → recipient's first name from the target group CSV
{{.LastName}}       → recipient's last name
{{.Email}}         → recipient's email address
{{.Position}}      → recipient's position/role from the CSV
{{.URL}}           → the tracking URL pointing at your landing page
{{.Tracker}}       → invisible 1x1 pixel for email-open tracking (place in HTML body)

💡

The {{.FirstName}} personalization tag is the single highest-impact change you can make to a template's click-through rate. "Hi Sarah, your password expires…" consistently outperforms "Dear Employee, your password expires…" — sometimes by a factor of two or more.

3.2

Building the Password Reset Template in GoPhishFull HTML template · tracking pixel · subject line · preview

▾

ObjectiveBuild a complete, production-quality phishing email template in GoPhish's HTML editor for the password-reset scenario designed in Module 2.GoPhish

Step-By-Step

Open GoPhish → Email Templates → New Template
Name it "Hartley IT — Password Reset".
Set the envelope fields
Subject: Action Required: Your Microsoft 365 password expires in 24 hours — Envelope Sender: leave blank (set in Sending Profile).
Switch to HTML editor
Copy the template below into the HTML pane.
Verify all template variables are present
{{.FirstName}} in the greeting, {{.URL}} in the button link, {{.Tracker}} before the closing </body>.
Use the "Send Test Email" button
Send to your Mailtrap sandbox and verify how it renders — both HTML and plain-text fallback.

<!-- Paste this into GoPhish's HTML template editor -->
<!DOCTYPE html>
<html><head>
<meta charset="UTF-8">
<style>
  body{font-family:Segoe UI,Arial,sans-serif;background:#f0f2f5;margin:0;padding:20px}
  .wrap{max-width:560px;margin:0 auto;background:#fff;border-radius:6px;overflow:hidden}
  .hdr{background:#0078d4;padding:22px 28px}
  .hdr img{height:28px;vertical-align:middle}
  .hdr span{color:#fff;font-size:1.1rem;font-weight:700;margin-left:10px;vertical-align:middle}
  .body{padding:28px 32px;color:#1a1a1a;font-size:14px;line-height:1.7}
  .btn{display:inline-block;margin:18px 0;padding:12px 28px;background:#0078d4;color:#fff;text-decoration:none;border-radius:4px;font-weight:700;font-size:14px}
  .footer{padding:14px 32px;background:#f7f7f7;font-size:11px;color:#888;border-top:1px solid #eee}
</style>
</head><body>
<div class="wrap">
  <div class="hdr"><span>Hartley Financial Services</span></div>
  <div class="body">
    <p>Hi {{.FirstName}},</p>
    <p>Our records show your Microsoft 365 account password is set to expire in <strong>24 hours</strong>. To avoid being locked out of your email and business applications, please reset your password now.</p>
    <a href="{{.URL}}" class="btn">Reset My Password</a>
    <p>If you do not reset your password before the deadline, your account will be locked and you will need to contact the IT Helpdesk to regain access.</p>
    <p>If you have already reset your password today, please disregard this message.</p>
    <p>Regards,<br><strong>Hartley IT Security Team</strong><br>helpdesk@hartley-financial.com | Ext. 4400</p>
  </div>
  <div class="footer">Hartley Financial Services · 1 Canary Wharf, London E14 5AB · This is an automated security notification. Do not reply to this email.</div>
</div>
{{.Tracker}}   <!-- open-tracking pixel — MUST be present for open metrics -->
</body></html>

💡

Always send a test email to Mailtrap and inspect both the rendered HTML view and the Raw source before launching a real campaign. Broken images, misaligned buttons, and missing tracker pixels are far easier to catch in Mailtrap than in a live campaign dashboard where you're wondering why opens aren't registering.

3.3

Two More Scenario TemplatesBEC wire-transfer · DocuSign document pending · how scenario choice affects risk rating

▾

ObjectiveBuild two additional templates covering the most common real-world pretext categories — BEC and document-signature urgency — and understand how each scenario maps to a different risk rating.GoPhish

Template 2 — BEC: CEO Wire Transfer Request

From: James Hartley <j.hartley@hartley-financial.com> | To: {{.FirstName}} {{.LastName}} | Subject: Urgent — Vendor Payment Needed Today

Hi {{.FirstName}},

I'm in back-to-back board meetings today and can't take calls. I need you to arrange a BACS payment of £23,500 to a new supplier before 4 PM today to secure our Q4 contract. I'll explain the full context this evening — please treat this as urgent and confidential for now.

Please click the link below to access the secure payment authorisation form. The reference code for this transaction is HFS-2026-Q4-0892.

Access Payment Authorisation Portal →

Thank you for handling this quickly.

James Hartley
CEO, Hartley Financial Services
+44 20 7946 0021 | j.hartley@hartley-financial.com

Template 3 — DocuSign Document Pending

From: DocuSign <dse@docusign.net> | To: {{.FirstName}} {{.LastName}} | Subject: [Action Required] Complete your document: Q4 Compliance Sign-Off

Hi {{.FirstName}},

Sarah Chen (Compliance, Hartley Financial Services) has sent you a document to review and sign.

Document: Q4 2026 Regulatory Compliance Acknowledgement
Deadline: 5 July 2026 (1 day remaining)

REVIEW DOCUMENT

DocuSign · The way the world agrees
This notification was sent on behalf of Hartley Financial Services. If you believe this is an error, contact your sender.

Scenario Risk Comparison

Scenario	Psychological Triggers	Typical CTR	Risk Rating
IT Password Reset	Authority, Urgency	15–30%	Medium — baseline for most first simulations
DocuSign Pending	Authority, Urgency, Social Proof	25–45%	High — exploits a trusted brand everyone recognizes
BEC Wire Transfer	Authority, Urgency, Liking	Highly variable	Critical — direct financial impact if successful for real

⚠️

The BEC template above is for simulation purposes against your own organization with explicit written authorization only. The authorization document from Module 0 must specifically name BEC as an approved pretext before you use it — some organizations explicitly exclude financial pretexts from simulation scope because of the distress they can cause even when acknowledged as a test.

🖥️

Module 4 – Landing Pages

2 labs · Building the credential-capture page · the mandatory training redirect · GoPhish setup

4.1

Building the Credential-Capture Landing PageHTML login clone · GoPhish capture settings · what gets tracked

▾

ObjectiveBuild a convincing login landing page in GoPhish that captures submitted credentials for reporting, and understand exactly what GoPhish records and what it doesn't.GoPhish

Step-By-Step

Open GoPhish → Landing Pages → New Page
Name it "Hartley — M365 Login".
Enable "Capture Submitted Data"
This records what users type into form fields — username but in this workbook NOT real passwords (see callout).
Enable "Capture Passwords"
For awareness — but understand this stores submitted passwords in GoPhish's database. In a real engagement, this setting needs explicit authorization and the data must be securely handled and deleted after reporting.
Set the Redirect URL
To the training page you'll build in Lab 4.2. This is non-negotiable: a click that ends in a dead page or a real login success is an incomplete engagement.
Paste in the landing page HTML below
A Microsoft 365 login clone.
Save and preview
Check it renders correctly in your browser before any campaign uses it.

<!-- Microsoft 365 login clone — paste into GoPhish Landing Page HTML editor -->
<!DOCTYPE html>
<html><head>
<meta charset="UTF-8">
<title>Sign in to your account</title>
<style>
  body{font-family:Segoe UI,Arial,sans-serif;background:#f2f2f2;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}
  .card{background:#fff;padding:44px 44px 36px;width:360px;box-shadow:0 2px 6px rgba(0,0,0,.1)}
  .logo{font-size:24px;color:#0078d4;font-weight:300;margin-bottom:22px}
  h1{font-size:1.4rem;font-weight:600;color:#1a1a1a;margin-bottom:18px}
  input{width:100%;border:1px solid #ccc;padding:9px 10px;font-size:14px;margin-bottom:14px;outline:none;box-sizing:border-box}
  input:focus{border-color:#0078d4}
  .btn{width:100%;background:#0078d4;color:#fff;border:none;padding:10px;font-size:14px;cursor:pointer;font-weight:600}
  .small{font-size:12px;color:#666;margin-top:12px;text-align:center}
</style>
</head><body>
<div class="card">
  <div class="logo">Microsoft</div>
  <h1>Sign in</h1>
  <form method="POST" action="">
    <input type="email" name="email" placeholder="Email, phone, or Skype" required>
    <input type="password" name="password" placeholder="Password" required>
    <button type="submit" class="btn">Sign in</button>
  </form>
  <p class="small">Can't access your account?</p>
</div>
</body></html>

GoPhish Setting	Effect
Capture Submitted Data: ON	Form field contents recorded per recipient in campaign results
Capture Passwords: ON	Password field stored — treat this data with the same sensitivity as real credentials
Redirect URL: training page	After submission, user is immediately redirected to the awareness training page

⚖️

Submitted data (including anything typed into the password field) is stored in GoPhish's SQLite database. In a real engagement, this data must be access-controlled, encrypted at rest, included in the data-handling clause of your authorization document, and securely deleted after the report is delivered. In this classroom lab, use only fake credentials — never enter real passwords into any lab landing page.

4.2

The Awareness Training Redirect PageThe mandatory landing point after a click — teaching the moment of highest receptivity

▾

ObjectiveBuild the awareness redirect page that every recipient sees immediately after clicking — the most important pedagogical moment of the entire engagement.Awareness

The moment a recipient realizes they clicked on a simulation is the moment they're most receptive to learning. This page must do three things: confirm it was a simulation (clearly, without shaming), explain exactly what they should have noticed, and give them one concrete thing to do differently next time.

Step-By-Step

Create a second Landing Page in GoPhish
Name it "Hartley — Awareness Training Redirect".
Paste in the awareness HTML below
Customize the "red flags" section to match your specific template from Module 3.
Set this as the Redirect URL in Lab 4.1's landing page
So every form submission lands here.
Also host a direct link to it
So you can include it in the post-campaign training email even for people who didn't click.

<!-- Awareness redirect page HTML -->
<!DOCTYPE html>
<html><head>
<meta charset="UTF-8">
<style>
  body{font-family:Segoe UI,Arial,sans-serif;background:#fff3cd;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}
  .card{background:#fff;border-radius:8px;padding:40px 44px;max-width:540px;text-align:center;box-shadow:0 4px 20px rgba(0,0,0,.1)}
  .icon{font-size:3rem;margin-bottom:14px}
  h1{color:#e65c00;font-size:1.5rem;margin-bottom:12px}
  p{color:#333;font-size:14px;line-height:1.7;margin-bottom:12px;text-align:left}
  .flags{background:#fef3cd;border-left:4px solid #e65c00;border-radius:0 8px 8px 0;padding:12px 16px;text-align:left;margin:14px 0}
  .flags li{margin-bottom:6px;font-size:13px}
  .action{background:#0078d4;color:#fff;display:inline-block;padding:11px 26px;border-radius:4px;text-decoration:none;font-weight:700;margin-top:14px}
</style>
</head><body>
<div class="card">
  <div class="icon">🎣</div>
  <h1>This Was a Phishing Simulation</h1>
  <p>You've just completed a security awareness exercise run by the Hartley IT Security team. <strong>No real data has been captured and your account is safe.</strong></p>
  <p>Here are the signs that this was not a real Microsoft email:</p>
  <ul class="flags">
    <li>The sender domain was not @microsoft.com — hover over any link before clicking</li>
    <li>Real Microsoft password notifications include your full name and account details</li>
    <li>The link URL did not point to login.microsoftonline.com</li>
    <li>Urgent 24-hour deadlines are a common phishing trigger — slow down and verify</li>
  </ul>
  <p><strong>Next time:</strong> If you receive an urgent email asking you to log in or take financial action, verify it by calling the sender directly using a number from the company directory — not the number in the email.</p>
  <a href="https://hartley-security-training.internal/phishing-module" class="action">Complete the 5-Minute Training →</a>
</div>
</body></html>

📋

The tone of this page matters as much as the content. "You failed a phishing test" produces defensiveness. "You've just completed a security exercise" followed by specific, actionable red flags produces learning. The same information, framed differently, has completely different training outcomes.

🚀

Module 5 – Campaign Execution

3 labs · Target groups, campaign launch, real-time monitoring, and handling employee reports

5.1

Building Target Groups in GoPhishCSV format · segmentation by department · position data for spear-phishing

▾

ObjectiveCreate target groups in GoPhish using the required CSV format — and understand why department segmentation is essential for meaningful results.GoPhish

⚖️

In this classroom lab, the target group CSV contains only your own email addresses (personal test accounts, Mailtrap sandbox addresses) or those of classmates who have explicitly consented in writing. Never enter colleagues', strangers', or students' real email addresses without documented, prior consent.

Step-By-Step

Create a CSV with the required headers
GoPhish accepts exactly these columns: First Name, Last Name, Email, Position. Any deviation causes an import error.
Build two groups
Simulate Hartley's two highest-risk departments: Finance/AP (BEC targets) and General Staff (credential harvest targets). In a real engagement, this segmentation lets you compare click rates between departments.
Import via GoPhish → Users & Groups → New Group → Bulk Import Users
Upload the CSV and confirm the preview shows the correct names and email addresses.

# Required CSV format — no spaces after commas, headers exact
First Name,Last Name,Email,Position
Test,Student,your-own-email@test.com,Finance Manager
Classroom,Participant,classmate-consent@test.com,AP Clerk
Lab,Account,mailtrap-sandbox@test.com,General Staff

# Why Position matters:
# GoPhish inserts it via {{.Position}} in templates
# Spear-phishing that references the recipient's real role
# consistently outperforms generic pretexts

Group	Pretext Best Suited To	Why
Finance / AP team	BEC wire transfer, invoice approval	These roles have actual payment authority — the highest-value target for real BEC actors
IT / Technical staff	Credential harvest, password reset	IT accounts have broader access — credential theft has highest blast radius
General staff	DocuSign, HR benefits, IT password reset	Largest population, baseline susceptibility measurement
Executives / C-suite	Requires specific authorization, often excluded	High distress risk; results must be handled with extreme confidentiality

5.2

Launching and Monitoring a CampaignNew Campaign wizard · schedule settings · live timeline · what each status means

▾

ObjectiveLaunch your classroom campaign against your own test addresses, and read the real-time timeline the way a campaign operator monitors a live engagement.GoPhish

Step-By-Step

Open GoPhish → Campaigns → New Campaign
Fill in every field before launching.
Configure the campaign fields
Name → Email Template → Landing Page → URL → Launch Date → Send By date → Sending Profile → Groups. The URL field must point to GoPhish's phishing listener, not the admin port.
Set the "Send By" date
This throttles delivery over time — spreading 340 emails over a 2-hour window looks more like normal business email traffic than sending all at once.
Launch and immediately open the campaign timeline
You'll see events appear in real time as emails are delivered, opened, clicked, and as credentials are submitted.
Interact as a recipient
Open your Mailtrap inbox, click the link in the simulation email, and watch the GoPhish timeline update.

GoPhish Status	What It Means	How It's Recorded
Email Sent	GoPhish successfully sent the email to the SMTP relay	Timestamp in timeline
Email Opened	The tracker pixel in the HTML body loaded in the recipient's email client	Timestamp + user-agent string
Clicked Link	The recipient clicked the {{.URL}} link in the email	Timestamp + IP + user-agent
Submitted Data	The recipient submitted the landing page form	Timestamp + submitted form fields
Email Reported	The recipient forwarded the email to GoPhish's IMAP monitor — the best possible outcome	Timestamp — triggers "reported" status

💡

The "Email Reported" status requires configuring GoPhish's IMAP monitoring feature with the organization's phishing-report mailbox (typically report@company.com or phishing@company.com). Setting this up before a campaign launches is important — it's how you reward employees who correctly identified the simulation.

5.3

Handling Edge Cases During a Live CampaignEmployee escalations · IT ticket storms · "did we get hacked?" calls

▾

ObjectivePrepare for the operational realities of a live phishing campaign — because employees don't behave predictably, and the IT team will almost certainly call someone.

Common Edge Cases and How to Handle Them

Situation	What Happens	How to Handle It
Employee reports to IT as real phishing	IT may block the sending domain, generating a ticket storm and potentially ending the campaign early	Brief the IT Security lead in advance — give them a campaign code to look up, not details that could leak
Employee reports genuine distress	Someone who recently experienced fraud may react with anxiety to a BEC simulation	HR escalation contact (named in auth document) takes the call — confirm it's a simulation only to the affected person
Executive assistant flags it to the CEO	CEO may call the CISO demanding to know if they've been hacked	The CISO should be briefed in advance with a campaign code — never deny a simulation when asked directly by a senior leader
Automated security tools block the domain	Email gateway or endpoint tool recognizes GoPhish headers and blocks all campaign emails	Pre-whitelist your phishing domain with the email gateway, clearly documented in the engagement scope
Employee posts about it on Slack/Teams	"Has anyone else got a weird Microsoft email?" — alert spreads, later recipients don't click	Acceptable — it means security culture is working. Note the time it took for the information to spread.

⚠️

Never lie to an employee who directly asks "is this a phishing test?" — this crosses an ethical line that no amount of realism justifies. The standard answer is: "I'm not able to confirm or deny the status of any security exercises, but if you have a concern about this email please forward it to [security@company.com]." That's honest, it maintains the test integrity, and it rewards the right behaviour.

📊

Module 6 – Results Analysis & Reporting

3 labs · Reading campaign metrics, department breakdown, and writing a board-ready report

6.1

Reading and Interpreting Campaign MetricsClick rate · submission rate · report rate · time-to-click · what each number actually means

▾

ObjectiveExtract GoPhish's campaign results, calculate the key metrics, and understand what each one tells you about the organization's actual security posture.

The Metrics That Matter

Metric	Formula	What It Tells You
Email Open Rate	Emails Opened ÷ Emails Sent	Deliverability and subject-line quality — a low open rate means the email landed in spam or was ignored before reading
Click-Through Rate (CTR)	Links Clicked ÷ Emails Sent	Core susceptibility metric — the percentage of people who would have taken action on a real attack
Credential Submission Rate	Submitted Data ÷ Links Clicked	Of those who clicked, how many completed the "attack" — a high submission rate suggests low awareness of login-page red flags
Reporting Rate	Emails Reported ÷ Emails Sent	The most positive metric — employees who correctly identified and reported the phishing simulation
Mean Time to Click (MTTC)	Average time from delivery to first click	Fast MTTC (<5 min) suggests high automation or urgency response; slow MTTC suggests deliberation

Step-By-Step

Export your campaign results from GoPhish
GoPhish → your campaign → Results tab → Export CSV.
Calculate each metric above
Use a spreadsheet — understanding what goes into each number is more valuable than reading a pre-calculated dashboard figure.
Compare to industry benchmarks
First-time simulation: 20–35% CTR is typical across industries. Financial services tends to run 15–25% — but varies widely by pretext quality and employee training history.

🎯

A reporting rate above 20% on a first simulation is excellent — it means 1 in 5 employees recognised and acted correctly. Report this prominently in your findings; acknowledging what went well is as important as identifying weaknesses, and it motivates continued engagement with security awareness programs.

6.2

Department-Level AnalysisSegmenting results · high-risk departments · position correlation

▾

ObjectiveBreak down campaign results by department, identify which groups require prioritized training, and understand position-based risk correlation.

Step-By-Step

Open the exported CSV
Filter by the Position column to calculate CTR per department.
Build a department heat map
A simple table: Department | Targeted | Clicked | CTR | Reported. Sort by CTR descending.
Identify the highest-risk department
For Hartley, Finance/AP clicking on the BEC template above industry average is the critical finding.
Cross-reference with access privilege
A 40% CTR in IT is more alarming than a 40% CTR in Facilities — IT accounts have broader access. Weight your risk narrative accordingly.

# Example department breakdown table
Department      | Targeted | Clicked | CTR   | Reported
----------------|----------|---------|-------|----------
Finance / AP    |   42     |   18    | 43%   |    2
IT / Technical  |   28     |    7    | 25%   |    8
Operations      |   95     |   24    | 25%   |   11
General Staff   |  175     |   39    | 22%   |   23
----------------|----------|---------|-------|----------
Total           |  340     |   88    | 26%   |   44

⚠️

Individual-level results (who clicked, who submitted credentials) must be treated as sensitive HR data. In the report, present department-level aggregates to leadership, never individual names. Individual results are for HR/line-manager conversations in private, and only where the organization has explicitly authorized that level of disclosure in the engagement terms.

6.3

Writing the Board-Ready Engagement ReportExecutive summary · risk narrative · findings · recommendations · re-test date

▾

ObjectiveWrite a complete engagement report that the CISO can present to the Hartley board — non-technical in summary, data-supported in detail, and actionable throughout.

Report Structure

Section	Content	Length
Executive Summary	What was tested, the headline number (26% CTR), and the single most important recommendation — written for someone who will not read the rest of the report	1 page
Engagement Overview	Scope, authorization, dates, scenarios tested, methodology	1 page
Key Findings	Overall metrics, department breakdown, notable behaviours (fast clickers, reporters), comparison to industry benchmark	2–3 pages
Risk Narrative	What a real attacker could have achieved with the same access — specifically for Hartley, what the 43% Finance/AP CTR means in the context of the BEC incident that triggered this engagement	1 page
Recommendations	Numbered, specific, prioritized by risk — not "improve security awareness" but "implement mandatory phishing training for Finance/AP within 30 days"	1 page
Re-test Schedule	Proposed date for the next simulation (90 days is standard), and the metrics you'll use to measure improvement	Half page

🎯

The most persuasive sentence in the report is not a percentage — it's a dollar figure or a consequence. "26% of Finance/AP staff would have completed a wire transfer request in the same scenario as the incident that cost the company £47,000" is more compelling to a board than "26% CTR." Always connect the simulation to the real-world incident or risk that justified it.

🎓

Module 7 – Security Awareness Training Program

4 labs · Turning simulation results into a training program that actually changes behaviour — and a 12-month cycle

7.1

Building the Targeted Training CurriculumWhat to teach · how to teach it · the red flags from YOUR campaign

▾

ObjectiveDesign a training curriculum that addresses exactly what employees clicked on in the Hartley simulation — not generic phishing advice, but specific lessons built from real results.Awareness

The Four Training Tiers

Audience	Training Content	Delivery Method
All staff (clicked)	The five specific red flags from your campaign's email and landing page; how to verify an email before clicking; the report button	10-minute interactive module, mandatory completion within 48h
Finance / AP (BEC pretext)	BEC recognition and verification procedures; the dual-authorisation rule for any payment request received by email	30-minute department workshop, in person or live video
IT / Technical	Why they're targeted specifically; credential hygiene; reporting procedures and how IMAP monitoring works	Peer-led technical discussion — 30 mins
All staff (didn't click)	Positive reinforcement; what they noticed that others didn't; the report button reinforcement	5-minute written communication from CISO — not training, recognition

Step-By-Step

Write the five specific red flags from your campaign
Not generic advice — the exact indicators in the email and landing page from Module 3. Employees learn better from what they experienced than from theoretical examples.
Design the Finance/AP workshop agenda
30 minutes: 10 min — what happened in the simulation, 10 min — real BEC examples (anonymised), 10 min — the new dual-authorisation procedure for email payment requests.
Draft the CISO recognition email
For staff who correctly reported. Short, specific, warm — acknowledges the action by name if the organization permits it.

💡

Research consistently shows that training delivered within 24–48 hours of a simulation is 3–4x more effective than training delivered weeks later. Schedule the mandatory training module to unlock immediately after campaign close — not at the next quarterly all-hands.

7.2

The Phishing Reporting CultureReport buttons · what happens after a report · rewarding the right behaviour

▾

ObjectiveBuild the infrastructure and culture that makes reporting phishing emails the obvious, easy, and rewarded behaviour — not just for simulations, but for real attacks too.

The Reporting Infrastructure Stack

Component	What It Is	How to Set It Up
Report button	One-click "Report as Phishing" in Outlook/Gmail	Microsoft Defender's "Report Message" add-in (free, deploy via M365 Admin); Google's "Report phishing" is built in
Security mailbox	security@ or phishing@ address — the destination for reports	Create a shared mailbox; configure GoPhish's IMAP monitoring against it for simulation tracking
Triage SLA	How fast you acknowledge a report and confirm real vs simulation	Target: acknowledge within 1 business hour; resolve within 4 — communicate this SLA to all staff
Reporter recognition	Positive reinforcement for employees who report	Automated "thank you for reporting" email; monthly recognition in team communications for early reporters

Step-By-Step

Draft the "Thank You for Reporting" auto-response email
Sent automatically to anyone who reports to the security mailbox — confirms receipt, sets the expectation for follow-up, and reinforces that reporting was the right action.
Write the internal communication announcing the security mailbox
All-staff message: "If you ever receive an email that seems suspicious, forward it to security@hartley-financial.com. We'll check it within the hour and let you know. If it turns out to be real, you may have just stopped an attack."
Design the reporter recognition scheme
Monthly "first reporter" acknowledgement in the team channel. Low-friction, public, positive. Not a gift card scheme — that creates perverse incentives to report everything indiscriminately.

📋

The goal is not zero-click rates. The goal is a high reporting rate — an organization where most people who receive a phishing email, real or simulated, forward it to security. That's a more resilient posture than one where people merely don't click, because it creates an early-warning system for real attacks that get through your technical controls.

7.3

Technical Controls That Reinforce TrainingMFA · email gateways · DMARC enforcement · the human-plus-technical model

▾

ObjectiveConnect the awareness training to the technical controls that make credential theft less consequential even when an employee does click — because training alone is not a sufficient defence.

The Control Stack

Control	What It Does	How It Limits Phishing Damage
Multi-Factor Authentication (MFA)	Requires a second factor beyond the password	Stolen password from a phishing landing page is worthless without the second factor — stops the most common credential-harvest path cold
DMARC enforcement (p=reject)	Rejects emails spoofing Hartley's own domain	Prevents external attackers from sending email that appears to come from @hartley-financial.com — the exact attack vector in the original BEC incident
Email gateway with phishing detection	Scans inbound email for known-malicious indicators	Blocks the majority of mass-phishing; less effective against targeted, novel spear-phishing
Anti-spoofing headers + display-name warnings	Outlook/Gmail warns users when the display name doesn't match the sending domain	Surfaces the mismatch that GoPhish's templates exploit — makes the red flag visible in the UI
Payment dual-authorisation	No wire transfer proceeds on an email request alone — requires a phone confirmation	The one control that would have stopped the original Hartley BEC incident — and the simplest to implement

🎯

If Hartley had enforced MFA and implemented payment dual-authorisation before the original incident, the BEC would have failed regardless of whether employees clicked. Technical controls are not a replacement for training — they're the safety net that makes a successful click survivable. Recommend both in your report, not one or the other.

7.4

The 12-Month Simulation CycleCadence · scenario rotation · measuring improvement · closing the loop

▾

ObjectiveDesign a sustainable 12-month simulation and training cycle for Hartley that measures real improvement rather than just running annual "checkbox" tests.

The Annual Cycle

Month	Activity	Scenario
Month 1	Baseline simulation (this workbook's engagement)	IT password reset — medium difficulty
Month 1–2	Training delivery to all staff, Finance/AP workshop, CISO recognition email	—
Month 3	First re-test — same scenario, same pretext	IT password reset — measure improvement from baseline
Month 6	Second simulation — harder scenario	DocuSign document pending — tests a different trigger
Month 6	Targeted training for departments that show regression	—
Month 9	Third simulation — hardest scenario, if authorized	BEC wire transfer — for Finance/AP only, with specific authorization
Month 12	Annual review — compare all four simulations, update training program, set next year's baseline	—

Measuring Real Improvement

Track CTR trend, not just current CTR
A drop from 26% to 18% to 12% over three simulations is the story. A single 12% is just a number.
Track reporting rate trend separately
The reporting rate often rises faster than CTR falls — both trends belong in the annual report.
Rotate scenarios to avoid "trained to the test"
If you run the same scenario three times, employees start recognising the scenario format, not phishing indicators. Each cycle should introduce a new pretext category.
Connect metrics to real incidents
Did a real phishing attempt occur this year? Was it reported? Did the reporter use the same reporting button from training? That closed-loop story is the most powerful ROI metric you can give a board.

🎯

Engagement fully closed when: the board has the initial report, training has been delivered and attendance confirmed, the Month 3 re-test is scheduled in the CISO's calendar, and the security mailbox is live with its triage SLA communicated to all staff. Everything else — the 6-month and 9-month simulations — follows from this foundation.

Phishing Simulation
& Security Awareness

⚖️ MANDATORY LEGAL BRIEFING — Read This Before Lab 0.1

📑 Table of Contents

Module 0 – Orientation & Engagement Planning

Module 1 – Infrastructure Setup

Module 2 – Target Intelligence & Pretexting

Module 3 – Phishing Email Templates

Module 4 – Landing Pages

Module 5 – Campaign Execution

Module 6 – Results Analysis & Reporting

Module 7 – Security Awareness Training Program

🎉 Engagement Complete — Operation: HOOK, LINE & SINKER

Phishing Simulation& Security Awareness

⚖️ MANDATORY LEGAL BRIEFING — Read This Before Lab 0.1

📑 Table of Contents

Module 0 – Orientation & Engagement Planning

Module 1 – Infrastructure Setup

Module 2 – Target Intelligence & Pretexting

Module 3 – Phishing Email Templates

Module 4 – Landing Pages

Module 5 – Campaign Execution

Module 6 – Results Analysis & Reporting

Module 7 – Security Awareness Training Program

🎉 Engagement Complete — Operation: HOOK, LINE & SINKER

Phishing Simulation
& Security Awareness