# Phishing Overview

> Phishing / social-engineering catalog for the Phisher agent. Use ONLY when the engagement RoE authorizes a phishing engagement. Covers pretext design, GoPhish campaigns, evilginx2 MFA-bypass proxying, O365 credential/token harvest, lookalike domains, and the mandatory blue-team deconfliction handshake.

- Skill: `purpleailab/phishing-overview` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/phishing-overview`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/phishing-overview/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/phishing-overview

---


# Phishing / Social-Engineering Skill Catalog

**Gating.** Every skill here refuses to execute unless the engagement
RoE authorizes a phishing engagement and the blue-team
deconfliction handshake (`lure-deconfliction`) has completed. Phishing
real employees without written authorization is a crime — the RoE +
deconfliction ack are the operator's legal coverage.

## Playbooks

| Skill | Use for |
|---|---|
| `/skills/standard/phisher/pretext-engineering/SKILL.md` | Design the pretext + target shortlist from OSINT (LinkedIn / Hunter.io) |
| `/skills/standard/phisher/gophish-campaign/SKILL.md` | GoPhish API: groups, email templates, landing pages, campaign launch + tracking |
| `/skills/standard/phisher/evilginx2-proxy/SKILL.md` | evilginx2 phishlet authoring; capture session cookies past MFA |
| `/skills/standard/phisher/o365-credential-harvest/SKILL.md` | O365 / Entra OAuth device-code + token capture and replay |
| `/skills/standard/phisher/lookalike-domain/SKILL.md` | Punycode / lookalike domain + DNS + TLS provisioning |
| `/skills/standard/phisher/lure-deconfliction/SKILL.md` | MANDATORY pre-send handshake with the blue-team contact |

## Infrastructure pattern

```
[Target inbox] -> [NGiNX reverse proxy on attacker domain]
                  ├─ /login   → evilginx2 phishlet (MFA bypass + session capture)
                  └─ /landing → GoPhish (campaign tracking + analytics)
```

- The NGiNX layer is OPSEC: blue-team URL classifiers see one domain;
  internal routing splits phishlet vs landing by path / referer.
- TLS via Let's Encrypt + `acme.sh`; keep ACME challenges off the
  phishlet path.
- SPF / DKIM / DMARC must be correct on the sender domain or modern
  inboxes drop the mail. Soundwave's phishing template walks the
  operator through DNS setup.

## Deconfliction (mandatory)

Every outbound mail carries an engagement header
(`X-Decepticon-Eng: <slug>`) the SOC allow-lists so simulated phishing
is distinguishable from a real attack. The `lure-deconfliction` skill
is a hard gate before the first send — skipping it is a critical RoE
violation.

## Failsafe

On operator stop or SOC request, wind down within 5 minutes: pause the
GoPhish campaign, return 502 on the evilginx2 phishlet, and repoint the
sender domain to a static "this was an authorized test — contact your
security team" page.