Skip to content

Phishing

Phishing lets you run built-in (internal) phishing exercises directly from OpenAEV, without deploying any external component. It is modeled on Gophish: you author reusable, platform-themed Landing Pages and Email Templates as Components, and each Landing Page automatically becomes a Threat Arsenal action you can use in an Inject.

Phishing is available in the Community Edition and reuses the platform's global SMTP configuration (the same EmailService as the built-in email Injector) to deliver lure emails.

Why use phishing?

  • Run credential-harvesting awareness exercises against your Players using content you fully control.
  • Reuse a single Landing Page or Email Template across many Simulations instead of rebuilding the content each time.
  • Track open, click, and submit events per recipient, and have those events automatically fulfill the Inject's expectations.

Warning

Phishing is intended for authorized security awareness exercises against your own users only. You are responsible for obtaining the proper authorization before running any exercise.

Landing Pages

A Landing Page is the page a recipient sees after clicking the link in a lure email. Open Components > Phishing > Landing pages to manage them.

To create a Landing Page:

  1. Click Create a landing page.
  2. Fill in the fields:
Field Description
Name The Landing Page name, also used as the label of the generated Threat Arsenal action.
Description Optional free-text description.
HTML The page body. A live, light-canvas preview shows exactly what recipients see, with a fullscreen mode for inspection.
CSS Optional styling applied to the page.
Branding Optional dark and light logos used by the platform-themed wrapper.
Redirect URL Optional page the recipient is sent to after submitting. Only relative paths and http(s) URLs are accepted.
Capture settings Whether submitted data (and passwords) are captured.

The rendered HTML and CSS are sanitized (DOMPurify) before being shown to recipients, and the public page is fully sandboxed.

Each Landing Page synthesizes its own InjectorContract bound to the internal phishing Injector, so it appears as an action in the Threat Arsenal. Creating, updating, or deleting a Landing Page keeps that action in sync.

You can generate the HTML with Generate with AI when XTM One is configured (Enterprise Edition). See XTM Suite connector.

Email Templates

An Email Template is the lure email sent to recipients. Open Components > Phishing > Email templates to manage them.

To create an Email Template:

  1. Click Create an email template.
  2. Fill in the fields:
Field Description
Name The Email Template name.
Description Optional free-text description.
Subject The email subject line.
Sender name / Sender email Optional overrides for the from name and from address.
HTML body The email content. Use the {{ phishing_url }} placeholder for the click link. A live preview shows the rendered email.
Text body Optional plain-text alternative.
Tracking pixel When enabled, a 1x1 tracking pixel is added so opens can be tracked.

Email Templates are offered as a choice on every Landing Page action, so adding or removing a template updates the chooser on the Landing Page contracts automatically.

The HTML body can also be produced with Generate with AI when XTM One is configured.

Run a phishing exercise

  1. Create an Inject and select the Threat Arsenal action generated by your Landing Page.
  2. Choose the target Teams, the Email Template, and any optional subject / sender overrides.
  3. When the Inject executes, each recipient gets a per-recipient lure email with a unique tracking link.
  4. Open (tracking pixel), click (landing page), and submit (captured credentials) events are recorded per recipient and fulfill the Inject expectations.

Submitted credentials are stored as a Credentials Finding.

Landing page URLs

Each recipient receives a unique, opaque link. The link uses a benign, tenant-less shape so the address bar and the email body read like a generic authentication URL rather than exposing internal details:

https://<host>/auth/<token>

The <token> is a globally unique, per-recipient identifier. The platform recovers the owning tenant from the token alone, so the URL never contains a tenant identifier. The public open (tracking pixel), click (landing page), and submit (credentials) endpoints are served under /api/hosted/** and are authenticated solely by this token.

Note

Links in emails that were already sent keep working: the legacy tracking endpoints remain available for backward compatibility.

Custom domains

By default, landing pages are served from the platform host. You can instead serve them from a hostname you own (for example secure.example.com) so lure links match your organization's branding. Open Settings > Customization > Custom domains to manage them.

To register a custom domain:

  1. Click Register a custom domain and enter the hostname.
  2. The platform returns the DNS records to publish. Add them at your DNS provider to prove ownership and route traffic to the platform.
  3. Once the records are live, click Verify. The platform resolves the records and, on success, marks the domain Verified.

Only a Verified custom domain is served: an on-demand-TLS edge checks ownership against the platform before obtaining a certificate for an inbound hostname, so an unverified or unknown host is refused.

Managing custom domains reuses the tenant settings permission, so any administrator who can edit the other tenant customizations can manage them.

Warning

Point a custom domain only at hostnames you control and are authorized to use for awareness exercises.

Default content

On first startup, each tenant is seeded with a default platform-themed Landing Page and Email Template so you can run an exercise immediately. You can edit or delete them like any other Component.

What's next?