# Offensive Phishing

Phishing campaign execution methodology for authorized red team engagements.

- Repository: https://github.com/SnailSploit/Claude-Red (10186 stars)
- Category: Design
- License: MIT
- Last updated: 2026-10-12
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add SnailSploit/Claude-Red --skill offensive-phishing -g -a claude-code -y`
Codex: `npx skills add SnailSploit/Claude-Red --skill offensive-phishing -g -a codex -y`
Cursor: `npx skills add SnailSploit/Claude-Red --skill offensive-phishing -g -a cursor -y`
Gemini CLI: `npx skills add SnailSploit/Claude-Red --skill offensive-phishing -g -a gemini-cli -y`

## Description

Phishing campaign execution methodology for authorized red team engagements. Covers end-to-end campaign lifecycle: infrastructure provisioning (GoPhish, SMTP relay configuration, domain acquisition and aging, SPF/DKIM/DMARC alignment), payload delivery vectors (Office macro weaponization, HTA droppers, ISO/IMG container abuse, LNK shortcut hijacking, OneNote embedded payloads, HTML smuggling), email authentication bypass techniques (SPF softfail exploitation, DKIM replay attacks, display name spoofing, homoglyph and cousin domain registration), credential harvesting with MFA bypass (EvilGinx2 transparent proxy, Modlishka session relay, pixel-perfect HTML cloning), spear phishing pretext development informed by OSINT, email security gateway evasion, QR code phishing (quishing), and callback phishing for initial access. Integrates with GoPhish for campaign management, EvilGinx2 for adversary-in-the-middle credential interception, King Phisher for template design, and the Social Engineering Toolkit for payload generation. Maps to MITRE ATT&CK T1566 (Phishing) and sub-techniques T1566.001 (Spearphishing Attachment), T1566.002 (Spearphishing Link), T1566.003 (Spearphishing via Service). Assumes you have written authorization and a defined scope before any campaign execution.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Offensive Phishing

Phishing remains the most reliable initial access vector in red team engagements. You are simulating a real adversary -- your infrastructure, pretexts, and payloads must withstand the same scrutiny that a targeted organization's email security stack applies to inbound mail. This skill walks you through building campaigns that test an organization's human and technical defenses against email-based social engineering.

Every technique here assumes you hold explicit written authorization. Document your scope, target lists, and escalation procedures before sending the first email.

## Quick Workflow

1. Register a lookalike domain 4-8 weeks before the engagement; configure DNS records for SPF, DKIM, and DMARC alignment.
2. Stand up GoPhish on dedicated infrastructure; configure SMTP relay through a reputable provider or self-hosted MTA.
3. Develop pretexts based on OSINT -- org announcements, vendor relationships, internal processes.
4. Build or clone landing pages; deploy EvilGinx2 phishlets if MFA bypass is in scope.
5. Craft payloads matched to the target's email security posture (macro-enabled docs, HTML smuggling, ISO containers).
6. Send test emails to your own accounts first; verify rendering, link tracking, and payload delivery.
7. Launch the campaign in waves; monitor GoPhish dashboard for opens, clicks, and credential submissions.
8. Document findings with timestamps, screenshots, and affected user counts for the final report.

---

## Infrastructure Setup

Your sending infrastructure determines whether mail reaches the inbox or lands in quarantine. Treat infrastructure provisioning as the foundation of every campaign.

### Domain Acquisition and Aging

The rest: https://github.com/SnailSploit/Claude-Red/blob/HEAD/Skills/social-engineering/offensive-phishing/SKILL.md