Authorized Red Team Phishing: Templates, GoPhish and Ethical Guardrails

A client signed the Rules of Engagement on Friday, and by Monday morning 1,847 employees received an email cloning the timesheet portal. Within 38 minutes: 312 clicks, 89 credentials harvested, zero SIEM alerts. That is the kind of operation that separates authorized phishing from criminal fraud: letterhead contract, execution window, and a CISO phone number that can kill everything in 30 seconds if anything escalates. Red team phishing is not about tricking humans, it is about measuring the human attack surface with the same rigor we measure the network surface in Advanced Nmap: NSE Scripts for Internal Recon in a Simulated Corporate Lab.

What separates authorized phishing from fraud#

The difference is not the technique, it is the paper that comes first. A criminal phisher and a red teamer use the same tools; what sends one to jail and pays the other is a signed authorization document with a clear scope, a named sponsor, and a liability frame. Without that document, every email you send is a crime, however noble the intent. That is why every serious campaign begins not in the GoPhish admin panel but with the client's legal and compliance team signing off on the frame. The document is not a formality, it is your only defense when an employee files a complaint or an auditor asks questions six months later.

Rules of Engagement and exclusions#

Before any send, the authorization document must list allowed domains, source IP ranges, send windows, exclusion criteria (C-suite, HR in active labor litigation, underage interns), and what happens to captured credentials. Skip this and the work becomes the Coalfire-Iowa 2019 case, where two pentesters got arrested mid-engagement because written scope did not cover physical intrusion. Serious red team writes personal OPSEC before operational OPSEC, and the material in OPSEC for Security Researchers: Building a Personal Threat Model applies directly here because the operator ends up carrying client secrets across the engagement boundary.

GoPhish architecture#

GoPhish went viral in 2016 and remains the swiss army knife of simulation because it ships REST API, tracking pixel, cloneable landing pages, and CSV reports in a 25 MB Go binary. Typical architecture: dedicated VPS with a never-before-used IP, a reverse proxy (nginx or Caddy) in front of the admin panel, which is never publicly exposed, and separate hosts for sending and landing so that blocking the landing does not kill delivery. Treat the infrastructure as production-grade, with the same discipline as Building C2 Infra with Sliver in an Isolated Lab for Defensive Research. The admin panel belongs behind a VPN or IP allowlist; a publicly reachable GoPhish panel is itself a vulnerability.

Deliverability: domain, SPF/DKIM/DMARC, IP warm-up#

The best campaign dies in the spam filter if deliverability is wrong. Register the domain at least 30 days ahead (ideally a typosquat like rnicrosoft-login.com that reads like microsoft in the font), configure SPF, DKIM, and DMARC cleanly through Postfix or SendGrid, and warm the IP over days with rising volume. Without IP warm-up, the mail lands in Microsoft Defender quarantine before reaching the inbox. Test against mail-tester.com and a real Outlook 365 tenant before going live, because what looks clean in Thunderbird can get flagged red in Defender.

Templates that work in 2026#

Templates that work in 2026 are not Nigerian prince anymore. The Proofpoint top three last quarter: a DocuSign signature expiring in 24 hours, a DHL parcel held at customs with a $4.99 fee, and a Microsoft Teams invite from a real director (lifted off LinkedIn) calling an urgent meeting. Every template must render identically in Outlook 2021, Gmail Web, and iOS Mail, which requires inline tables, embedded CSS, and images on a reputable CDN. The initial-access vector can still be an attachment, and the trade-offs across macro, LNK, and ISO are dissected in Simulated Initial Access: Macros, LNK and ISO in an Isolated Windows 11 Lab with concrete detection examples.

The landing page: ethical credential handling#

Landing pages are where 70% of teams blow it. Capturing a password in plaintext through an HTTP form is amateur hour and a GDPR violation even inside an authorized scope. The ethical pattern: hash the password client-side with SHA-256 plus an engagement salt, store only the first eight hex characters of the digest to confirm collection, and immediately redirect to a training page explaining the simulation. Log user-agent, IP, timestamp, and click-to-submit delta, but never the full credential. That data feeds the improvement loop described in Purple Team in Practice: Building a Red vs Blue Feedback Loop, where the blue team turns every click into a detection rule.

Metrics and reporting#

Raw click rate is the worst metric you can report because it breeds fear and improves nothing. Report instead: time to first click, time to first report to the SOC (the most important number, because fast reporting beats a low click rate), the reporter-to-clicker ratio, and a quarter-over-quarter comparison with similar cohorts. A team that reports fast is safer than one with few clicks but no reporting culture. The report belongs de-identified: aggregate per department, never a named list of clickers to management, or you turn a security exercise into a disciplinary instrument.

Psychological fallout#

The part nobody talks about at conferences: psychological fallout. In a real 2024 campaign with 4,200 targets, 11 employees took stress leave after learning they had been caught, and two sued the employer. Post-campaign debriefs need an occupational psychologist on call, a same-day CEO communication, and the success metric cannot be raw click rate. Operators also need to shield their own identity during the engagement, as detailed in Digital Compartmentalization: Separate Identities Without Leaking Metadata, because the operator inevitably learns sensitive internal facts about the target.

Dry-run and kill switch#

For teams just starting, the honest path is: build the internal lab first (GoPhish plus Mailhog plus five test accounts), validate templates against your own Outlook, run a dry-run with the client security team watching live, and only then fire in production. Wire a kill switch that drains the campaign in 60 seconds through the API and switches the landing to a neutral page. Document every decision in a signed changelog, because six months later an auditor will ask why you mailed a specific person. The dry-run almost always surfaces a rendering bug or a misconfigured DMARC that you cannot fix once you are live.

Pretexting and OSINT recon#

A credible pretext does not come from nowhere, it comes from careful, strictly passive OSINT within the agreed scope. From LinkedIn you pull names, roles, hierarchies, and the tone of internal communication; from the business registry the legal entity; from job ads the software in use (whoever hires SAP consultants runs SAP, which carries the pretext). A strong pretext combines authority (a real director's name), urgency (a 24-hour deadline), and plausibility (an event the recipient expects, such as the annual salary review). This is exactly where the ethical line sits: OSINT stays passive and in scope, you never collect private data outside the professional context and never use family members as leverage, because that leaves any awareness exercise and becomes targeted harassment. Document every source so the report shows how little publicly visible information was needed to build a convincing lure.

Multi-channel: vishing and smishing#

Email alone is just one channel in 2026. Mature campaigns combine, when the RoE explicitly cover it, email with an SMS follow-up (smishing) or a call (vishing) that amplifies urgency: the email announces, the call pushes for immediate action. This combination raises the click rate dramatically, but it also raises the ethical and legal risk, which is why each channel must appear separately in the authorization, with its own exclusion list and its own kill switch. Vishing needs a script that can reveal the simulation within two minutes at most, and a recorded client consent that calls are part of the mandate. Running multi-channel without explicit coverage turns a legitimate exercise into potential coercion; the added value never justifies crossing the paper.

Common pitfalls#

The most expensive mistakes: leaving the admin panel publicly reachable, storing credentials in plaintext, mailing C-suite despite the exclusion, launching the campaign without a CEO heads-up, and selling raw click rate as success. Equally dangerous: shipping real malware instead of a harmless simulation in the attachment, because that leaves the scope of an awareness exercise and becomes a real incident. And never hand a named list of clickers to HR unless the RoE explicitly allow it, or you destroy trust for every future exercise.

Checklist#

Short version for the runbook: (1) Signed RoE with scope, exclusions, send window. (2) Domain aged, SPF/DKIM/DMARC set, IP warmed. (3) GoPhish panel behind VPN/allowlist. (4) Template tested in Outlook/Gmail/iOS. (5) Landing hashes client-side, never stores plaintext, redirects to training. (6) Kill switch tested. (7) CEO communication ready, psychologist on call. (8) Metrics: time to report, reporter-to-clicker. (9) Report aggregated, no named list. (10) Signed changelog of every decision.

FAQ#

May I store real credentials to prove access?#

No. Never store the full password. Proof that someone clicked and entered data comes from the hashed prefix, the timestamp, and the submit event, without ever persisting the plaintext password. Storing plaintext is a GDPR violation and turns you into a data risk, because your GoPhish server then becomes a worthwhile target.

Should click rate be the main goal?#

No. The most meaningful number is time to report to the SOC. An organization where many click but someone reports within two minutes is more resilient than one with few clicks and no report. Optimize reporting culture, not pure click avoidance.

Conclusion#

Takeaway: authorized phishing is 20% technique, 30% paperwork, and 50% empathy for whoever clicks. Without all three, do not send. The best campaign does not end with a click rate, it ends with an organization that reports faster, one more detection rule in the SIEM, and not a single employee who feels publicly humiliated.