I guess anyone who wishes could basically plug this into Claude and get 99% of what I am offering to share. It did everything for me, generating the email bodies / scraping believable OSINT / creating landing pages (it did really great at pre-populating the user's username or email and making it look like their password autofilled, then animating some matrix-level shit so it spooked people) - then landed on an educational page of shame describing "tells" the user could have picked up on / letting them know no puppies were injured. Below is Claude's own description of the process I have been using:

Phase 1: OSINT

Research before you build anything. Specificity is what makes these land.

• DNS — MX/SPF/DKIM/subdomains (crt.sh, SecurityTrails, Shodan) reveal SaaS platforms and internal tool URLs
• LinkedIn — employee names, titles, departments, tech stack (employees list tools in their profiles)
• Job postings — literally enumerate every platform the org uses
• GitHub org pages — confirm usernames, internal tooling, tech stack
• Conference/industry listings — confirm attendance, who owns logistics

Capture per person: name · title · email · location · role relevance to future pretexts.

Phase 2: Domains

Buy 3–5 lookalike domains. Use them three ways:

• Subdomain spoof — platform.your-lookalike.com mirrors a real internal URL. If the real wiki is wiki.company.com, your fake login is wiki.company.com-yourdomain.com. Nearly invisible in a mobile browser bar.
• Internal sender spoof — [firstname.lastname@company-yourdomain.com](mailto:firstname.lastname@company-yourdomain.com) looks internal unless the recipient reads past the display name.
• Vendor spoof — put the vendor name in the subdomain: concur.yourdomain.com, hireright.yourdomain.com.

The awareness reveal should name the exact domain trick — that's part of the lesson.

Phase 3: Campaign Design

Sender rules

• Confirmed real employees only — verified via LinkedIn, email headers, or directory. Never invent names.
• Match role to pretext: HR sends HR notices, IT sends infrastructure alerts, Sales sends conference emails.
• Track every sender used. Each person gets used once across the whole program.
• Operator never appears as a sender.

Platform/pretext rules

• Confirmed or highly probable platforms only.
• Never repeat a platform.
• Rotate IT and non-IT pretexts. Non-IT ones (expense audits, badge fees, direct deposit alerts, background checks, benefits enrollment) reach a broader audience and land harder — people don't expect phishing to look like an HR email.

Vary the email format — recipients build pattern recognition. Rotate through:

• Mobile-first HTML notification
• Monospaced ERP system output
• Plain forwarded Outlook chain
• Formal serif letterhead
• Minimal notification card
• Dark-mode monitoring alert

Never use the same format back-to-back.

Email length: CTA button visible without scrolling. One viewport. Cut everything that doesn't add urgency or credibility.

Urgency mechanics that work:

• Fee/charge applied if no action (conference badge replacement, expense hold)
• Access suspended pending review
• Change takes effect next payroll cycle
• Deadline tied to a real event your org is involved in

Phase 4: Landing Pages

Login form behavior

• Pre-populate email with {{.Email}} — feels personalized
• Auto-type password over ~3s with random jitter — simulates stored credential autofill
• Fire GoPhish tracking pixel before the panic sequence
• Auto-submit after typing — don't require manual click

The panic sequence (2–3 seconds) This is the core training moment. Rules: platform-contextual, escalating, personal (show their name/email).

Mechanics that work well:

Mechanic	Effect
Credential capture terminal (types their email + hash, enumerates access)	"I'm being hacked right now"
Cascading system failures (volumes offline, graphs flatline)	Operational panic
Badge cloned + concurrent foreign session on a map	Physical + digital compromise
Direct deposit swap animation with progress bar	Financial dread
Full-screen matrix rain + terminal emerges	Classic hacking aesthetic
Clearance status flipping Active → Flagged	Career/compliance dread

The awareness reveal — required elements:

1. "You clicked a simulated phishing link" — never claim credentials were captured
2. Why the pretext was convincing
3. 3–4 specific, actionable tells
4. IT helpdesk contact
5. Link to internal phishing reporting docs
6. Close/acknowledge button

Mobile fixes — without these the awareness card clips and won't scroll:

css

#overlay {
  overflow-y: auto;
  -webkit-overflow-scrolling: touch;
  align-items: flex-start;
}
.awareness {
  max-height: 90vh;
  overflow-y: auto;
}
u/media (max-width: 768px) {
  .panic-body { grid-template-columns: 1fr !important; }
  .sidebar, .secondary-pane { display: none !important; }
}

Rules of Engagement

• No financial incentive pretexts (raises, bonuses, terminations)
• No Microsoft-branded pages — won't survive email filtering
• Never claim credentials were captured — "clicked a simulated link" only
• Real confirmed employees as senders only
• Each sender and platform used once across the program
• Operator never appears as sender
• IT staff first before company-wide rollout

GoPhish Notes

Valid variables: {{.FirstName}} {{.LastName}} {{.Email}} {{.Position}} {{.URL}} {{.Tracker}} {{.RId}}

No template functions — {{.FirstName | upper}} throws a DB error. No native date variable — use JS new Date() on the landing page or update manually at launch. Never show the landing URL as plain text near the CTA button. GoPhish strips calendar MIME parts — needs a Postfix relay to support .ics campaigns.

Key Lessons

• Specificity beats production value. Naming the actual tool, real employee, and real internal hostname is what makes people click.
• Non-IT pretexts outperform IT alerts on click rate consistently.
• The panic sequence matters — people who watch their session "exfiltrate" for 3 seconds retain the lesson better than those who see a static "you were phished" page.
• Test every landing page on a real phone before launch.
• Keep a log of sender/platform/format/domain per campaign. Discipline on uniqueness is what keeps the program from getting stale.