phishkitAuthorized phishing assessments, end to end

Alpha software. Authorized AiTM plus a native email campaign engine in one local desktop app — not a beta, not production. Build from source.

Quick start

Authorized use

View on GitHub

One end-to-end workflow

Assessment → Target → Phishlet/Proxy → Lure → Template → Recipients → Campaign → Results → Session, all in the desktop app.

Native email campaign engine

Draft/review/test/launch campaigns with your SMTP or ESP, scheduling and send windows, delivered/opened/clicked/bounced tracking, and reporting.

Real session capture

evilginx captures what an attacker would actually get, with deterministic attribution back to the campaign attempt and a focused Sessions view.

Dual audience

A guided wizard and curated presets with safe defaults for business users, layered over full Advanced controls for expert operators.

This is an alpha

v0.1.0 is a primitive alpha: we are assembling and testing the product. It is not a beta and not a production release. Expect breaking changes, missing polish, unsigned builds, and gaps in the integration suite. Build from source. Do not treat a GitHub tag as a supported installer channel.

For authorized assessments only

phishkit drives an adversary-in-the-middle proxy, sends email, and handles captured credentials and live session tokens. Use it only with explicit written authorization from the owner of the targeted systems and people.

Read authorized use and the threat model before you run anything. The supported product is the desktop app under apps/desktop/ (plus the headless CLI).