What Is GoPhish?

GoPhish is an open-source phishing simulation framework written in Go, originally designed for legitimate security testing and awareness training programs. The platform provides templates, landing pages, email campaign management, and comprehensive tracking capabilities that enable security teams to create realistic phishing simulations for employee education. However, since its public release on GitHub, GoPhish has been extensively abused by threat actors for malicious phishing campaigns targeting credential theft and malware delivery, according to Cisco Talos Intelligence's October 2024 threat research.

The framework's dual-use nature creates a persistent challenge for defenders: the same features that make GoPhish valuable for security testing—realistic templates, campaign tracking, credential capture, and detailed analytics—also make it effective for criminal operations. Available free as open-source software with binaries for Windows, Mac, and Linux, GoPhish requires no licensing fees or underground market access, enabling both legitimate security professionals and malicious actors to deploy sophisticated phishing infrastructure with minimal investment.

How Does GoPhish Work?

GoPhish operates through a web-based administrative interface that manages all aspects of phishing campaign creation, deployment, and tracking. The framework's architecture separates campaign management from phishing content delivery, enabling operators to control multiple concurrent campaigns from a centralized dashboard.

Campaign creation begins with email template development. GoPhish provides a template editor where operators compose phishing emails including subject lines, sender information, message bodies with HTML formatting, and embedded images or attachments. The framework supports variable substitution, enabling personalized emails that reference recipient names, departments, or other contextual information that increases credibility. Templates can replicate common business communications like password reset notifications, IT security alerts, invoice requests, or document sharing invitations.

Landing pages represent the second critical component. When recipients click links in phishing emails, they reach web pages designed to capture credentials, deliver malware, or collect personal information. GoPhish's landing page editor enables operators to create forms that mimic authentic login portals, survey pages, or file download interfaces. The framework automatically captures any data submitted through these forms, storing credentials, personal information, or tracking user interactions for later analysis.

The campaign management system coordinates email distribution and tracks victim interactions. Operators define recipient lists by manually entering email addresses or importing CSV files with contact information. The framework sends emails either through its built-in SMTP server or by connecting to external email services. As campaigns progress, GoPhish tracks delivery confirmations, email opens, link clicks, data submissions, and any reported phishing attempts, providing real-time dashboards that visualize campaign effectiveness.

For legitimate security testing, this tracking enables organizations to identify employees vulnerable to phishing, measure awareness training effectiveness, and demonstrate compliance with security training requirements. Security teams can create realistic threat simulations that closely resemble actual phishing attacks employees might encounter, then use the results to target additional training toward departments or individuals showing high susceptibility.

When threat actors abuse GoPhish for malicious purposes, they leverage identical functionality for criminal objectives. Malicious operators deploy the same template creation, landing page design, and campaign tracking features, but instead of security education, they pursue credential theft for account takeover, personal information collection for identity theft, or malware delivery for system compromise.

According to Talos Intelligence's October 2024 research, threat actors have modified GoPhish to enhance criminal operations. Common modifications include removing the distinctive "X-GoPhish" email header that identifies messages sent through the framework, eliminating the "_gorilla_csrf" cookie name that provides a detection signature, obfuscating admin panel URLs to avoid identification through automated scanning, and implementing user-agent filtering to block security researchers while allowing victim access.

The framework's legitimate availability through multiple distribution channels facilitates both authorized and malicious deployment. GoPhish source code is maintained on GitHub at github.com/gophish/gophish with continuous updates and community contributions. Pre-compiled binaries are available for download from getgophish.com, eliminating compilation requirements for non-technical users. The framework appears in Kali Linux, the popular penetration testing distribution, providing institutional legitimacy that complicates efforts to label GoPhish as purely malicious. Docker container versions enable rapid deployment in cloud environments without complex configuration.

Talos documented specific malicious campaigns employing GoPhish for PowerRAT and DCRat delivery. In these operations, threat actors sent phishing emails with malicious Word document attachments or HTML files containing JavaScript. When victims opened these files on systems where they had clicked "enable content" or executed scripts, the documents downloaded and installed remote access trojans that provided attackers with persistent backdoor access. GoPhish's campaign tracking allowed attackers to identify which victims opened emails and clicked links, enabling focused attention on successfully compromised targets.

How Does GoPhish Differ From Other Phishing Platforms?

GoPhish's most fundamental distinction is its legitimate origin and dual-use nature. Unlike BlackForce, ClickFix, Kr3pto, and similar platforms explicitly designed for criminal purposes, GoPhish was created for authorized security testing. This legitimate foundation creates unique challenges for defenders—blocking GoPhish infrastructure risks interfering with authorized security programs, while permitting it enables criminal abuse. BlackForce and similar tools face no such ambiguity; they serve exclusively malicious purposes and can be blocked without concern for legitimate use.

The open-source free availability sets GoPhish apart economically. While threat actors must purchase BlackForce for €200 to €300 or subscribe to ClickFix services at $200 to $1,500 monthly, GoPhish requires zero financial investment beyond infrastructure hosting. This accessibility attracts different threat actor demographics—opportunistic attackers experimenting with phishing, resource-constrained criminal operations, and attackers who wish to avoid payment trails that commercial tool purchases create. The source code availability enables technically skilled operators to modify GoPhish extensively, removing detection signatures and adding capabilities without depending on vendor updates.

GoPhish lacks native MFA bypass capabilities that distinguish advanced platforms like BlackForce and Kr3pto. The framework captures whatever credentials victims submit on landing pages but provides no mechanisms for intercepting one-time passwords, defeating push notifications, or otherwise bypassing multi-factor authentication. Attackers using GoPhish against MFA-protected accounts must employ separate techniques or accept that credential capture alone may not enable account access. This limitation makes GoPhish more suitable for initial reconnaissance, malware delivery, or targeting services without MFA protection rather than sophisticated account takeover operations.

The framework's detection signatures create advantages for defenders while motivating attacker modifications. Default GoPhish installations include identifiable markers like the X-GoPhish email header and _gorilla_csrf cookie name that enable straightforward detection. Email security gateways can implement simple rules blocking these signatures, providing effective defense against unmodified GoPhish campaigns. However, according to Sprocket Security's research on evading security controls with GoPhish, removing these signatures requires only basic configuration changes, meaning sophisticated attackers can eliminate these detection points while retaining full functionality.

GoPhish's campaign tracking and analytics capabilities exceed many specialized criminal phishing kits. The framework provides detailed dashboards showing email delivery status, open rates, click-through rates, credential submission counts, and timeline visualizations. For legitimate security programs, this enables data-driven security awareness training improvements. For criminal operations, it provides operational intelligence about campaign effectiveness, victim demographics, and optimal timing for attacks. Hunt.io's research tracking GoPhish infrastructure noted that attackers frequently iterate campaigns based on tracking data, refining lures and targeting based on which templates generate highest victim engagement.

The global deployment scope reflects both legitimate and malicious use. Hunt.io documented GoPhish infrastructure targeting Polish energy and government sectors with over 7,600 domains registered between late 2024 and February 2025. This massive infrastructure deployment demonstrates how GoPhish's accessibility enables large-scale operations. In contrast, specialized tools like Kr3pto maintain focused infrastructure targeting specific sectors, while GoPhish's generality enables attackers to rapidly pivot across industries and geographies.

Why Does GoPhish Matter?

GoPhish represents a broader challenge in cybersecurity: dual-use tools that serve both legitimate defensive purposes and malicious attack operations. The platform's significance extends beyond its technical capabilities to fundamental questions about open-source security tool availability and responsibility.

The framework's contribution to legitimate security programs provides measurable value to organizations implementing security awareness training. According to TechTarget's tutorial on using GoPhish for security awareness training, organizations can demonstrate compliance with regulations requiring phishing education, identify high-risk employees who frequently fall for simulations, measure awareness improvement over time through comparative campaign results, and justify security training investments through quantified susceptibility reductions. These legitimate benefits create constituencies defending GoPhish's continued availability despite criminal abuse.

Criminal adoption of GoPhish demonstrates how open-source availability lowers barriers to sophisticated attacks. Talos Intelligence's October 2024 documentation of Russian-speaking threat actors deploying DCRat and PowerRAT via GoPhish infrastructure shows how freely available frameworks enable threat actors without software development expertise to conduct complex campaigns. Rather than developing custom phishing infrastructure, attackers can deploy production-ready frameworks within hours and focus their efforts on social engineering, target selection, and post-compromise activities.

The framework's appearance in Kali Linux, the industry-standard penetration testing distribution maintained by Offensive Security, provides institutional legitimacy that complicates mitigation efforts. Security professionals worldwide use Kali Linux for authorized testing, and GoPhish's inclusion signals acceptance within the legitimate security community. This legitimacy makes it difficult for organizations to implement blanket blocks on GoPhish infrastructure without potentially interfering with authorized security testing. Defenders must distinguish between malicious and legitimate GoPhish deployments rather than simply blocking all instances.

GoPhish infrastructure's documented involvement in malware delivery campaigns elevates its threat level beyond simple credential harvesting. The October 2024 Talos research identified GoPhish campaigns delivering PowerRAT, a credential stealer and remote access trojan, and DCRat, a sophisticated backdoor enabling full system compromise. These campaigns demonstrate threat actor progression—using GoPhish for initial access through credential theft or malicious attachments, then deploying persistent malware for long-term access. This chaining of tools creates sustained compromise risks extending well beyond the initial phishing interaction.

The framework's extensive infrastructure deployment targeting critical sectors demonstrates real-world impact. Hunt.io's February 2025 tracking of GoPhish campaigns targeting Polish energy, government, and legal sectors with 7,600+ domains reveals systematic targeting of critical infrastructure. Energy sector compromise can enable operational technology attacks affecting power generation or distribution. Government targeting threatens sensitive information and citizen data. Legal sector compromise exposes privileged client communications and litigation strategies. The scale of this infrastructure indicates well-funded operations capable of sustained campaigns against high-value targets.

GoPhish's role in the broader phishing ecosystem influences how other tools evolve. According to Barracuda's January 2026 research on phishing kit evolution, features pioneered in legitimate frameworks like GoPhish—including campaign tracking, template libraries, and detailed analytics—have been adopted by explicitly criminal platforms like GhostFrame and ClickFix. This technology transfer demonstrates how innovations in defensive tools can paradoxically accelerate threat capability development as attackers study and replicate effective techniques.

What Are GoPhish's Limitations?

Despite its capabilities and widespread adoption, GoPhish faces several technical and operational constraints that create defensive opportunities and limit effectiveness for both legitimate and malicious use.

Detection signatures enable straightforward identification of unmodified deployments. Default GoPhish installations include easily detectable markers that email security gateways and network security systems can identify. The X-GoPhish email header appears in all messages sent through the framework's SMTP functionality unless manually removed through configuration changes. The _gorilla_csrf cookie name, generated by the Gorilla web toolkit GoPhish uses, appears in HTTP responses from landing pages. The framework's default 404 error pages contain recognizable HTML structure. REST API endpoints follow predictable URL patterns like /api/campaigns and /api/results. Hunt.io's guide to GoPhish detection documents that email gateways implementing simple header filtering rules can block substantial volumes of GoPhish campaigns from unsophisticated attackers who deploy the framework without modifications.

Performance limitations restrict campaign scale. GoPhish's default configuration uses SQLite, a file-based database suitable for small to medium deployments but not enterprise-scale operations. Large campaigns with tens of thousands of recipients can experience performance degradation, slow dashboard loading, and database locking issues. The framework lacks built-in load balancing, meaning single-server deployments create bottlenecks when campaign volume exceeds server capacity. Cookie handling can cause race conditions under high concurrent user access. These technical constraints mean that while GoPhish excels for focused campaigns, it requires substantial infrastructure investment and expertise to scale to massive operations comparable to commercial phishing-as-a-service platforms.

Infrastructure management creates operational overhead. Unlike service-based phishing platforms where providers handle infrastructure, GoPhish operators must manage their own servers, domains, and network connectivity. Attackers must register domains that appear legitimate enough to evade suspicion while avoiding trademark infringement that accelerates takedowns. They must provision hosting infrastructure either through commercial providers who may suspend accounts for terms of service violations or through compromised systems that may become unavailable unpredictably. They must maintain operational security to avoid exposure while keeping infrastructure accessible to victims. This self-hosting requirement increases complexity compared to platforms like ClickFix-as-a-Service where builders generate ready-to-deploy campaigns.

Lack of native obfuscation requires manual enhancement. GoPhish's design prioritizes functionality for legitimate security testing rather than evasion of security controls. The framework does not include built-in code obfuscation, anti-analysis techniques, or automated evasion capabilities. Attackers must manually modify source code to remove detection signatures, implement user-agent filtering to block security researchers, or obfuscate payloads to avoid antivirus detection. According to Sprocket Security's research, achieving effective evasion requires technical expertise beyond what many opportunistic attackers possess, creating a self-selection effect where successful GoPhish abuse correlates with attacker sophistication.

MFA protection limits value for many targets. As organizations increasingly implement multi-factor authentication on critical systems, GoPhish's credential-only capture becomes less valuable. Attackers can harvest usernames and passwords but cannot access MFA-protected accounts without additional techniques. This limitation drives attackers toward more sophisticated platforms like BlackForce with automated MFA bypass or requires supplementing GoPhish with separate social engineering to obtain one-time passwords. For legitimate security testing, this limitation actually provides value—organizations can measure whether MFA successfully prevents account access even when employees fall for phishing simulations.

Single point of failure in centralized architecture. GoPhish's administrative panel, phishing server, and database typically run on a single system or closely connected infrastructure. If this central infrastructure is detected and taken down through hosting provider abuse reports, law enforcement action, or DDoS attacks, entire campaign operations cease immediately. Unlike distributed peer-to-peer malware or blockchain-based command-and-control, GoPhish offers no resilience mechanisms. For legitimate security programs, this simplicity aids compliance and control; for criminal operations, it creates substantial operational risk.

How Can Organizations Defend Against GoPhish Abuse?

Defending against malicious GoPhish campaigns requires multi-layered controls that address both the framework's technical signatures and the broader phishing threat model it represents.

Implement email gateway filtering for GoPhish signatures. Email security systems should include rules detecting and blocking messages containing the X-GoPhish header or variations attackers might use. Gateway filtering should also flag emails from domains with recently registered WHOIS records, particularly when combined with other suspicious characteristics like urgent subject lines or unexpected attachments. According to Hunt.io's detection guide, examining HTML email source for _gorilla_csrf patterns or characteristic GoPhish template structures provides additional detection signals. Modern email security platforms should implement these rules by default while providing override mechanisms for authorized internal security testing.

Deploy link rewriting and real-time URL analysis. Email security solutions should rewrite links in messages to proxy through security analysis services that examine destinations before allowing user access. When recipients click links, these services can detonate URLs in sandboxed environments, observing actual page behavior rather than relying on static reputation. GoPhish landing pages often exhibit characteristic behaviors including form submission to non-standard endpoints, credential capture via AJAX requests, or redirection patterns designed to avoid analysis. Real-time analysis can identify these patterns even when specific GoPhish infrastructure is not previously known.

Monitor for PowerShell execution with suspicious characteristics. Since Talos documented GoPhish campaigns delivering PowerRAT and DCRat via PowerShell execution, endpoint detection and response solutions should implement behavioral monitoring for PowerShell invocations matching attack patterns. This includes PowerShell launched from Office applications after "enable content" actions, execution of obfuscated or encoded scripts, network connections to unfamiliar external hosts immediately following execution, and attempts to modify system registry for persistence. Microsoft Defender and similar EDR platforms can block or alert on these patterns, preventing malware installation even when users open malicious attachments.

Conduct user training emphasizing verification behaviors. Security awareness programs should teach employees to verify unexpected communications through independent channels before taking requested actions. Training should emphasize typing URLs directly rather than clicking email links for sensitive operations, contacting senders through known phone numbers rather than reply-to addresses when emails request unusual actions, examining sender domains carefully rather than just display names, and reporting suspicious emails to security teams rather than simply deleting them. Organizations should conduct periodic phishing simulations using legitimate tools to measure and improve employee recognition, creating competitive pressure that raises defense effectiveness.

Leverage threat intelligence feeds tracking GoPhish infrastructure. Organizations should subscribe to threat intelligence services that monitor GoPhish deployment patterns, including feeds from Cisco Talos, Hunt.io, and information sharing communities like the Anti-Phishing Working Group. These services track GoPhish infrastructure through various indicators including hosting providers commonly abused for phishing, domain registration patterns characteristic of campaigns, SSL certificate commonalities, and network infrastructure relationships. Implementing these indicators in firewalls, web proxies, and DNS filtering provides proactive blocking before users encounter malicious infrastructure.

Implement DNS monitoring for suspicious query patterns. GoPhish landing pages and admin panels create characteristic DNS query patterns that network monitoring can detect. Multiple employees querying recently registered domains within short timeframes may indicate ongoing phishing campaigns. DNS queries for admin panel URLs like /login, /api, or other characteristic GoPhish paths provide detection signals. Organizations should implement DNS logging and analysis tools like Zeek or commercial DNS security platforms that correlate queries across the network, identifying campaigns affecting multiple employees even when individuals might not recognize phishing attempts.

Coordinate authorized security testing through formal approval processes. Organizations conducting legitimate GoPhish deployments for security awareness should implement authorization and notification procedures preventing confusion with malicious campaigns. Security teams should coordinate with IT operations and email security teams before launching simulations, ensuring security controls can distinguish authorized testing from actual attacks. Some organizations implement dedicated domains for security testing that security systems whitelist, or require email security vendors to exempt internal security team communications from certain filtering rules during defined testing windows. This coordination prevents authorized testing from triggering false positive alerts while ensuring security controls remain effective against actual threats.

Investigate and respond rapidly to credential submission events. When security monitoring detects credential submission to potential GoPhish infrastructure—whether through network monitoring, endpoint detection, or user reports—organizations should implement rapid response procedures including immediately resetting potentially compromised credentials, analyzing systems used for submission for malware installation, examining email and network logs to identify campaign scope, and notifying other potentially affected employees. For GoPhish campaigns delivering malware rather than just harvesting credentials, response should include full forensic analysis of affected endpoints, network segmentation to prevent lateral movement, and threat hunting for indicators of compromise across the broader environment.