Phishing Club
Phishing Club is an open source phishing simulation and red team phishing framework for authorized security testing. Self host it on your own server via a one line installer or Docker.
Plan, launch, and measure realistic campaigns from a single Go binary with an embedded web UI, HTTP/HTTPS phishing servers, and a REST API.
Features: multi stage phishing flows, flexible scheduling, multiple domains with automatic TLS, SMTP or custom API delivery with OAuth, recipient groups with CSV import and SCIM, PDF campaign reports, analytics, multi tenancy, MFA and
SSO (Entra ID, OIDC), webhooks, and in app updates.
Red team and AiTM: reverse proxy phishing to capture sessions, remote browser phishing, DOM and URL rewriting, dynamic obfuscation, JA4 and geo IP filtering, and device code phishing.
Learn more about Phishing Club
PhishTitan
5.0 out of 5 stars
(5 Ratings)
Powerful Inline Phishing Protection for M365. Harness the power of AI and our LLM to defeat phishing. PhishTitan is next generation inline phishing protection and remediation, powered by TitanHQ, the global leaders in email cybersecurity.
Our proprietary large learning model and AI integrates directly with Microsoft 365, both catching and remediating sophisticated phishing and BEC attacks that Microsoft misses. It provides users with in-the-moment warning banners to help them decide whether an email is malicious or safe, continually enhancing the human firewall.
Risk free deployment in 6 minutes. PhishTitan will filter your email to identify phishing threats and protect your users and business. That’s how you AVOID that one wrong click that can lead to disaster – all it takes is 6 minutes! The TitanHQ team has been a category leader in the email security field for over 20 years. Bringing the experience of working with over 12,000 customers to our new phishing solution.
Learn more about PhishTitan
Terranova Security
Terranova Security makes it easy to build cybersecurity awareness programs that feature the industry’s highest-quality training content and real-world phishing simulations. As a result, any employee can better understand phishing, social engineering, data privacy, compliance, and other critical best practices.
Learn more about Terranova Security
Fallax
Fallax runs internal phishing simulations inside your own Google Workspace or Microsoft 365 tenant, trains people the moment they click, and turns the result into audit evidence.
Simulations are injected straight into mailboxes through your tenant, so there is no sending domain and nothing to allowlist: no SPF, DKIM or DMARC setup, no effect on email reputation. Anyone who clicks gets a short training page. Scheduling is per person and automatic, adjusted by how each one handled the last simulation, capped and paced by rules you set.
One export covers ISO 27001, SOC 2, NIS2, DORA, PCI DSS, HIPAA, GDPR Article 32 and NIST CSF, and syncs to Vanta, Drata, Secureframe and Sprinto.
Also included: phishing reports credited automatically from Outlook or a Gmail add-on, app discovery that aims lures at the tools staff really use, department standings, a REST API and an MCP server.
EU-hosted and GDPR compliant. Submitted credentials are never stored. First 10 seats free, permanently
Learn more about Fallax