Running phishing simulations with PhishFactory

How to read this manual

• Numbered markers on a screenshot point at a control. Hover a marker or its entry in the legend underneath to highlight it. Click a screenshot to view it full size.
• Figures marked GIF are recordings of the real portal. Use ↻ Replay to play one again from the start.
• Button and field names look like this: New campaign. They match the English interface. In German the labels are translated, but everything sits in the same place.
• Press ⌘ K (or Ctrl K) to search the manual. The search covers chapter text as well as titles.

The portal at a glance

Your first campaign, end to end

A campaign brings together four building blocks. Set each one up once, then reuse it in as many campaigns as you like.

1. Pick the right tenant. Use the tenant switcher in the top bar to choose the customer you're working for. Anything you create belongs to that tenant. See Tenants.
2. Check that a domain is ready. Under Domains, the domain needs nginx: active and TLS: active. The dashboard lists any domain that isn't fully set up.
3. Create or activate a template. Write the email under Templates, insert {{phishing_link}}, and mark its red flags. Only active templates can be picked for a campaign.
4. Create or activate a landing page. Under Landing pages. For a credential-capture page, point its form at {{data_submit_link}}.
5. Fill a group. Under Groups, import the recipients from a CSV file or add them one at a time.
6. Create the campaign. The four-step campaign wizard saves the campaign as a Draft. Nothing is sent yet.
7. Start it. The Start button () schedules the emails. They go out evenly spread across the send window.
8. Follow and report. Watch progress on the dashboard and under Send status, then open Reports for results and build the customer report.

Signing in

Open the portal address in your browser. You'll land on the sign-in page whenever you aren't signed in.

1. Enter your email. Use the address your administrator created your account with. Upper or lower case doesn't matter.
2. Enter your password. Passwords are at least 12 characters long.
3. Click Sign in. You'll land on the Dashboard, or on the page you originally asked for.

There is no self-service sign-up or password reset. If you've forgotten your password, ask an administrator to set a new one under Users → Edit.

If your account or your whole company has been deactivated, sign-in is refused even with the right password.

localhost:3000/login

GIF

localhost:3000/login

To sign out, click the Log out icon next to your name at the bottom of the sidebar.

Finding your way around

Every page shares the same frame: a dark sidebar on the left, a top bar with the tenant switcher, search and language, and the page content on a light background.

localhost:3000/campaigns

Working with tables #

Every list page (companies, domains, users, campaigns, templates, landing pages, groups, reports) works the same way:

• Summary tiles on the dark band at the top count what's in the list, e.g. how many campaigns are in progress.
• Search filters the rows as you type. Campaigns can also be found by tag.
• Sorting: click a column heading to sort by it, and click again to reverse the order. The arrow shows the current sort.
• Row actions sit on the right as icon buttons. Hover one to see its name. Anything destructive, like deleting or deactivating, asks for confirmation first.
• Forms open in a dialog on top of the list, so you don't lose your place. Press Esc or click Cancel to close one without saving. Opening a form's link directly in a new tab shows the same form as a full page.

localhost:3000/campaigns

GIF

localhost:3000/campaigns

GIF

Tenants: choosing which customer you work on

Each customer company is a tenant. Campaigns, templates, landing pages, groups, reports and users belong to exactly one tenant. The tenant switcher in the top bar decides which one you're looking at.

1. Click the tenant name in the top bar (next to TENANT).
2. Pick a customer from the list. Each entry shows the company's number and address. Your current one is marked Current.
3. The page reloads with that customer's data.

All tenants shows every customer's records at once, with an extra Customer column. It's read-only: to create or change anything, pick a single tenant first.

Administration (Company, Domains, Logs) stays available whichever tenant you pick. Domains are a shared pool that every tenant uses.

localhost:3000/dashboard

GIF

localhost:3000/tenants

Roles and permissions

Every account has one role. The role decides which sections appear in the sidebar and which actions are allowed.

Dashboard

The start page. It shows every campaign in the current tenant and how far each one has got, plus anything that needs your attention.

localhost:3000/dashboard

Company

Every customer on the platform. A company is a tenant: everything else, including its people, campaigns and reports, belongs to it.

localhost:3000/company

Create a company #

A new company is always created together with its first administrator. Without one, nobody at the new company could sign in.

1. Company: enter the Name, which email templates use as {{company}}. The Address is optional and defaults to "online". Click Continue.
2. Outlook add-in: both fields are optional. Security contact receives reports the Outlook "report phishing" button can't identify as a simulation. Mail domains match a reporting employee's email domain to this company. Type a domain and click Add.
3. First administrator: first name, last name, the Email they'll sign in with, and a Password of at least 12 characters. Click Create company.

localhost:3000/company

GIF

localhost:3000/company/new

Edit and deactivate #

localhost:3000/company/edit

localhost:3000/company

Domains

The look-alike domains that campaigns send from and host their landing pages and tracking links on. Domains are a shared pool: every tenant draws on the same list.

localhost:3000/domains

Add and provision a domain #

1. Click New domain and enter the host name only, e.g. login-nordbank.de. A scheme or path you paste is stripped automatically.
2. Add a description (optional) saying what the domain is for, then click Create domain.
3. Open Edit and, under Reverse proxy & TLS, click Provision. This sets up the nginx vhost on the server.
4. Click Issue certificate once nginx is active. The button stays unavailable until then.

The DNS record for the domain must already point at the PhishFactory server, or the certificate request fails.

TLS shows the result of the last certificate request. It isn't re-checked automatically, for example after a certificate expires or a renewal fails.

localhost:3000/domains/new

localhost:3000/domains/edit

Users

The people who can sign in to the current tenant, and what each of them may do.

localhost:3000/users

Create a user #

1. Click New user.
2. Fill in First name, Last name, and Email, which is what they'll sign in with.
3. Choose a Role. See Roles and permissions.
4. Set a Password of at least 12 characters, then click Create user.

localhost:3000/users

GIF

localhost:3000/users/new

Logs

An audit trail of every administrative change in the portal: who did it, to what, and what changed. Domain changes don't belong to any customer and are marked platform-wide.

localhost:3000/logs

localhost:3000/logs

GIF

localhost:3000/logs/entry

Campaigns

A campaign sends one template to one group, linking to one landing page on one domain, spread across a time window. This section takes it from draft to finished.

localhost:3000/campaigns

Campaign status

Row actions

Which buttons a row shows depends on its status.

Create a campaign #

New campaign opens a four-step wizard. The step list on the left shows what you've entered so far. Click a completed step to go back to it.

localhost:3000/campaigns

GIF

Step 1 · Details

• Name appears in the campaign list and in every report.
• Description (optional): what this simulation is testing.
• Tags (optional): click a suggestion such as finance or HR, or type your own and press Enter. You can search campaigns by tag later.

localhost:3000/campaigns/new

Step 2 · Audience and content

• Recipient group: who receives it. Each group shows its recipient count.
• Email template: only active templates are listed.
• Landing page: where the link leads. Only active pages are listed.
• Sending domain: the domain the mail comes from, which also hosts the tracking links.

localhost:3000/campaigns/new

Step 3 · Schedule

• Starts at: the date and time the first email may go out.
• Send window: the number of minutes to spread the emails over. They're sent evenly across it, so they never arrive in one suspicious burst. The bar underneath shows the resulting rate, e.g. "6 emails · one every 10.0 min".

localhost:3000/campaigns/new

Step 4 · Review

Check every setting, then click Create campaign. The campaign is saved as a Draft.

Recipients are frozen the moment you create the campaign. People you add to the group afterwards aren't included. Use Repeat later to send to the group's current members.

localhost:3000/campaigns/new

Start, cancel, and repeat #

1. Start: click on a draft. The dialog says how many real emails will be scheduled. Confirm with Start campaign.
2. Cancel: click on a scheduled or sending campaign and confirm with Cancel campaign.
3. Repeat: click on a finished or cancelled campaign and confirm with Create repeat, then set a new start date.

A send can't be undone. Once an email is out, cancelling only stops the ones that haven't gone yet.

localhost:3000/campaigns

Send status #

The button shows how a campaign is sending:

• Send timing: a chart of planned against actual sends per interval. Hover a bar for exact numbers.
• Send problems: every recipient whose email failed, with the number of attempts, the error, and whether it will be retried. Permanent failures are marked "Won't retry".
• Open full report goes to the campaign's report.

localhost:3000/campaigns

GIF

localhost:3000/campaigns/status

Templates

The phishing emails a campaign can send. Each one has a sender, a subject, an HTML body, and red flags that explain the deception to anyone who clicks.

localhost:3000/templates

The email editor #

localhost:3000/templates/edit

localhost:3000/templates/edit

GIF

Code view

Red flags #

Red flags are the deceptive details a recipient should have noticed. When someone clicks through, the awareness page shows them the email again with each red flag highlighted and explained.

1. Select the deceptive text in the Visual editor, e.g. "urgent" or a fake link.
2. Click + Flag selected text. To flag the from-line or the subject instead, use + Flag sender or + Flag subject.
3. Enter a Title, e.g. "Lookalike sender domain", and an Explanation of why it's suspicious. The Marker ID is filled in for you.
4. Click Save red flag, then save the template.

localhost:3000/templates/edit

GIF

• Use the arrows to reorder flags, Show in editor to find the marked text, and Edit or Remove to change one.
• + Link existing marker picks up markers you typed by hand in Code mode (data-redflag="…" on any tag).
• A flag marked ⚠ Not found or empty has lost its text, usually because it was deleted in Code mode. Mark the text again or remove the flag.

Preview and test #

Preview & test

Awareness page

Compatibility

Landing pages

The page a recipient reaches after clicking the phishing link, for example a fake Microsoft 365 sign-in page that captures what's typed, or an awareness page.

localhost:3000/landing-pages

The landing-page editor #

localhost:3000/landing-pages/edit

• Name: what this page is, for whoever picks it for a campaign.
• Active: inactive pages stay editable but can't be picked for a campaign.
• Submit landing page: where a recipient goes after submitting a form on this page. With "— None —" the same page is shown again.
• Insert variable… offers {{mail_template}} (the email they received, rebuilt on the page) and {{data_submit_link}}.
• The editor, toolbar and Visual / Code switch work exactly like the template editor.

Groups

Recipient lists. A campaign sends to exactly one group.

localhost:3000/groups

Inside a group #

localhost:3000/groups/…

The header shows the number of recipients, who created the group, when it was last updated, and its ID ( copies it). Each recipient has Edit and Remove.

Add one recipient

1. Click Add recipient.
2. Enter email, first name and last name.
3. Save. An address that's already in the group is refused.

localhost:3000/groups/…

GIF

Import recipients from CSV #

1. Open the group and click Import recipients.
2. Click Download template if you need the file format. It has two example rows. Replace them with the real list.
3. Choose your file under CSV file and click Import recipients.
4. Read the result. It shows "n of m rows imported" and lists every rejected row with its line number and the problem.

localhost:3000/groups

GIF

File format

email;firstName;lastName
anna.berg@example.com;Anna;Berg
jonas.keller@example.com;Jonas;Keller

localhost:3000/groups/import

Reports

Results for every campaign in the tenant. Open one to see each recipient's outcome, export the raw data, or build the customer report.

localhost:3000/reports

The tiles show tenant-wide totals: campaigns (and how many have results), emails sent (and failed), click rate, and the share of recipients who reported the email with the Outlook add-in. Each row shows a campaign's sent count, open rate, click rate and submissions. Click a row to open its report.

A campaign's report #

localhost:3000/reports/…

Customer report builder #

Builds the management report you hand to the customer. Everything is saved as one report per campaign. There are no drafts or versions: exporting always uses what was last saved.

localhost:3000/reports

GIF

localhost:3000/reports/…/builder

Template variables

Placeholders that are replaced for each recipient when the email or page is sent. Insert them with { } Insert variable… or type them in.

FAQ and troubleshooting

"New campaign" says I need to pick a tenant.

You're viewing All tenants, which is read-only. Pick a single customer in the tenant switcher.

My template or landing page isn't in the campaign wizard.

It's inactive, or it belongs to another tenant. Activate it in its list, or check the tenant switcher.

A domain won't get a certificate.

Provision nginx first: Issue certificate stays unavailable until nginx is active. Also check that the domain's DNS points at the server.

I can't delete a campaign.

Scheduled and sending campaigns have to be cancelled first.

I added people to a group, but the running campaign didn't mail them.

A campaign's recipients are frozen when it's created. Use Repeat to send to the group's current members.

The CSV import rejects every row.

The column headers don't match, or the separator wasn't recognised. Download the template and compare it to your file's first row.

"Send test" says test delivery isn't set up.

No SMTP server is configured for test emails yet. Ask your platform administrator.

Who changed this?

Look it up in Logs: filter by target, then open the entry to see the before and after values.