🎣 Phishing Simulation
Phishing Simulation Reference
India-context phishing pretexts, GoPhish setup, landing pages, metrics, and security awareness guidance for authorised phishing simulation campaigns.
⚠️ Phishing simulations must have explicit written authorisation from the target organisation's senior management. Never conduct phishing without authorisation — it is illegal under the IT Act 2000 regardless of intent.
🇮🇳 India-Specific Phishing Pretexts
These pretexts exploit themes that are highly relevant to Indian users — regulatory notifications, government services, and familiar corporate scenarios. Sorted by typical click rate.
IT Helpdesk — Password Expiry
Very High click rate
IT / Corporate
Subject: "[Company] IT Support: Password Expiry Notice — Action Required"
Your corporate email/VPN password will expire in 24 hours. Reset it now to avoid being locked out.
🎯 Why it works: Deadline urgency. IT authority. Familiar workflow.
💡 Variation: Multi-Factor Authentication setup required within 24 hours to maintain system access.
RBI / Banking Alert
High click rate
BFSI employees, bank customers
Subject: "[Bank Name] Security Alert: Account Temporarily Restricted"
Urgent: Your [Bank Name] account has been temporarily restricted due to suspicious activity. Verify your details immediately to restore access.
🎯 Why it works: Financial fear. Authority (bank/RBI). Account loss threat.
💡 Works especially well in BFSI organisations where RBI notifications are expected and respected.
CERT-In Advisory
High click rate (security teams)
SOC / IT Security / CISO office
Subject: "CERT-In Critical Advisory: Immediate Action Required — Windows Vulnerability"
Critical vulnerability alert: CERT-In advisory CERT-In/2024-xxx requires immediate patching of your Windows systems. Download the emergency patch.
🎯 Why it works: Professional audience. Urgency. Familiar authority source.
💡 Targets security professionals specifically — often clicked due to job relevance.
GST / Income Tax Notice
Very High click rate
Finance / Accounts teams
Subject: "GSTN Alert: Discrepancy in Your GST Return — Penalty Applicable"
GST Filing Discrepancy — A discrepancy has been identified in your GSTN filing for FY 2023-24. Login to resolve before penalty is applied.
🎯 Why it works: Tax authority fear. Penalty threat. Financial consequence.
💡 Effective in finance and accounts teams. Also works as Income Tax or TDS notice variant.
HR — Salary Revision
Very High click rate
General employees
Subject: "[Company] HR: Your Salary Revision Letter is Ready"
Your salary revision for FY 2024-25 has been approved. Please review and acknowledge your new CTC letter.
🎯 Why it works: Financial reward anticipation. HR authority. Personal relevance.
💡 One of the highest click-rate pretexts globally. All employees are susceptible.
Courier / Delivery
High click rate
General employees
Subject: "Delivery Failed: Your Package Requires Action"
Your package from Amazon/Flipkart could not be delivered. Click to reschedule or it will be returned to sender.
🎯 Why it works: Familiar scenario. Mild urgency. Amazon/Flipkart are dominant in India.
💡 Effective for remote workers. Courier theme common in APT29 and BazarLoader campaigns.
Microsoft 365 / Google Workspace Login
Very High click rate
All corporate employees
Subject: "Microsoft 365: Session Expired — Sign In Required"
Your Microsoft 365 session has expired. Please sign in again to continue accessing your files and email.
🎯 Why it works: Extremely familiar UI. No urgency needed — credential harvest.
💡 Credential harvesting. Fake Microsoft login page captures username/password/MFA.
GoPhish Setup & Configuration
Installation
# Download GoPhish
wget https://github.com/gophish/gophish/releases/latest/download/gophish-VERSION-linux-64bit.zip
unzip gophish-VERSION-linux-64bit.zip && chmod +x gophish
# Configuration (config.json)
{
"admin_server": {
"listen_url": "127.0.0.1:3333",
"use_tls": true,
"cert_path": "gophish_admin.crt",
"key_path": "gophish_admin.key"
},
"phish_server": {
"listen_url": "0.0.0.0:443",
"use_tls": true,
"cert_path": "/etc/letsencrypt/live/yourdomain.com/fullchain.pem",
"key_path": "/etc/letsencrypt/live/yourdomain.com/privkey.pem"
},
"db_name": "sqlite3",
"db_path": "gophish.db",
"migrations_prefix": "db/db_",
"contact_address": "",
"logging": {
"filename": "",
"level": ""
}
}
# Run GoPhish
sudo ./gophish
# Access admin at https://127.0.0.1:3333 via SSH tunnel
SMTP Relay Options for Campaigns
| Option | Deliverability | OPSEC | Cost | Best For |
|---|---|---|---|---|
| SendGrid / Amazon SES | Very High — established reputation | Low — logs retained | Low | Internal campaigns where deliverability matters more than OPSEC |
| Postfix on VPS with valid PTR/SPF | High — if configured correctly | Medium | Very Low | Campaigns needing clean infrastructure |
| Client's own email relay (authorised) | Highest — internal sender | High — uses real domain | Free | When client wants truly realistic internal phishing test |
| Microsoft 365 / Google Workspace (test account) | High | Low | Low | Quick campaigns; limited by sending limits |
GoPhish Campaign Checklist
→
Test email delivery before campaign launch: Send test to multiple internal addresses. Verify landing in inbox, not junk.
→
Verify SPF, DKIM, DMARC on sending domain: If missing, email will be spam-filtered. Use MXToolbox to verify.
→
Confirm landing page tracking pixel works: GoPhish injects {{.TrackingURL}} — verify it loads without error.
→
Set up landing page redirect after submission: Redirect to real login page or internal page after credential capture — reduces suspicion.
→
Schedule campaign outside monitoring team's shift (if testing): For realistic assessment — or during business hours for representative results.
→
Have incident response ready: Some users WILL report the phishing. Have response ready: "This was an authorised simulation."
→
Document authorisation: Keep signed authorisation on file. If a user reports to law enforcement, you need documentation.
Campaign Metrics & Benchmarks
| Metric | Definition | Industry Benchmark | Good / Concerning |
|---|---|---|---|
| Open Rate | % of recipients who opened the email | 30–40% | Context: many email clients auto-load images = inflated open tracking |
| Click Rate | % of recipients who clicked the link | 15–25% baseline | <10% = good training. >30% = concerning. Target: <5% after training. |
| Submission Rate | % who submitted credentials on landing page | 5–15% | Any credential submission in banking/healthcare is concerning. |
| Report Rate | % who reported phishing to security team | 1–5% | Higher is better. Target: >20% after mature awareness programme. |
| Time to First Click | How quickly first click occurred after send | Often <5 minutes | Shows urgency/panic response — targeted training opportunity. |
| Repeat Clickers | Users who click in multiple campaigns | Typically 3–7% | These users need targeted 1:1 training intervention. |
Security Awareness — After the Campaign
The phishing simulation is the measurement tool, not the intervention. The intervention is what follows. A phishing simulation without a follow-up training programme is theatre — it produces data but changes nothing.
Immediate response (within 24 hours of campaign end)
→
Send debrief email to ALL employees — explain it was a simulation, what the indicators were, and what to do next time.
→
Never shame or name individuals who clicked — this destroys the reporting culture.
→
Acknowledge and publicly praise users who reported the phishing email.
→
Share aggregate metrics (X% of users clicked) — not individual results to managers.
Red flags in Indian phishing context — user training checklist
→
Sender domain mismatch: The email claims to be from SBI but comes from sbi-alerts.net — check the actual From address, not the display name.
→
Urgency without verification path: Legitimate RBI/CERT-In/IT notifications always provide a reference number and a way to verify via official channels.
→
Credential request via email link: No legitimate Indian bank, government body, or IT department will ask you to enter your password via an email link.
→
GST/Tax notices via email link: Authentic GSTN/IT notices require portal login — never via embedded email link.
→
Domain spoofing: paymentservices-rbi.com is not rbi.org.in. Check the full domain, not just the first word.
→
Hover before clicking: Hover over any link before clicking — the real URL appears in browser status bar or tooltip.