This lab, I conducted a phishing campaign on myself to gain familiarity with the tools attackers use. I began by searching online for publicly available datasets of real phishing emails and real ordinary emails. After downloading them, I ran a virtual machine of Kali Linux on my host device, which runs Fedora Linux. Kali Linux is a cybersecurity Linux distribution that comes equipped with cybersecurity tools and systems alike, including GoPhish, the most popular phishing campaign dashboard and campaign manager.
I then also searched for the commands to download the MailHog repository and run the instance locally through my Firefox web browser. After testing to ensure communication, I was ready to begin. I fed both datasets to Grok LLM, with explicit instructions to preserve all wording and simply keep track of which emails were legitimate versus which were not. I then asked it to return each one in randomized order, which I would then implement into its respective template. After that, I initiated the campaign. All emails from the GoPhish dashboard successfully reached my desired MailHog destination. The campaign was successful.
After ensuring I received the 10 legitimate emails and 10 fake emails, I tested myself to see if I could identify which were which. I went through and rated each one either "Real" or "Fake," recorded my confidence as "Low," "Medium," or "High," and explained my reasoning. After going through all 20 emails, I took my results and copied them back into Grok to cross-verify which I had correctly identified (losers), or mistakenly missed (winners). The results are as follows:
Out of 10 phishing emails, I identified 6 correctly and missed 4.
Out of 10 legitimate emails, I identified 7 correctly and missed 3.
After gathering the results, I collected the specific messages that I successfully identified as phishing, and the ones I didn't. I did not collect any of the legitimate emails, since I was measuring my ability to recognize phishing, and they are now irrelevant. I then ran each respective group into Hellhound, a social engineering meta-analysis tool. I ran each one, downloaded their .json files, and then cross-analyzed them through Hellhound again.
Some insights we can derive from these data points are that threat framing, urgency, call to action, and emotional pressure were recorded consistently higher among the winners, whereas losers had higher surface quality and personalization. There is a caveat for personalization, as it was high for both groups, but scored higher on average in the loser group. I identified messages more often when the attack was perceived as personalized, and classic strategies like urgency and threat framing were used in non-obvious ways, enough for the message to go undetected.
During the next offsec security awareness campaign, I would use this new information to eliminate all loser templates that used extra personalization and surface quality. I would also double down on the winners, which used more emotionally manipulative strategies like urgency and threat framing.
In this lab, I learned how to use GoPhish inside of a Kali Linux virtual machine, create templates, create a MailHog instance, and execute a phishing campaign. All network activity and digital behavior was executed 100% on myself. I also used Hellhound to exemplify its practical utility, the data it could provide, and the insights we could derive from said data.