Phishing Club

Phishing Club is an open source, self hosted platform for phishing simulations and authorized red team phishing. Organizations install it on their own servers with a single command or through Docker, so every campaign and all the data it gathers stay in house.

From the web console, operators build email and landing page lures, load targets from CSV or sync them over SCIM, group recipients, and schedule sends around working hours over SMTP or an OAuth capable API. As campaigns run, dashboards, per user event timelines, and automatically emailed PDF reports reveal who clicked, who reported the message, and who keeps falling for it. Multi tenancy lets service providers keep separate clients apart, and the admin area is protected by MFA and single sign on.

For offensive work it adds reverse proxy and remote browser phishing, session capture to bypass weak MFA, content and URL rewriting, page obfuscation, and JA4 and geo based access controls.