Creating a phishing campaign

This article includes the procedures for creating a phishing campaign in BullPhish ID.

NOTE  A video tutorial is available at the end of this article.

Prerequisites

  • A partner administrator, partner agent, and privileged user can create, edit, cancel, and delete a phishing campaign.
  • You must have an activated SMB organization.
  • You must create at least one group in BullPhish ID. Refer to the articles Creating a group or Adding a directory sync.

Phishing campaign

A phishing attack is an email scam where a cybercriminal impersonates a trustworthy person or entity to trick the recipient into revealing credentials, installing malware, or transferring money.

In BullPhish ID, you can create phishing campaigns that simulate phishing attacks and send them to your employees. These "fake” attacks allow you to test employee behavior and assess their knowledge regarding phishing attacks.

Key campaign attributes

While there are several attributes you specify or are automatically calculated when creating a phishing campaign, the key attributes are explained below:

  • Campaign Start Date: This is the date the phishing campaign emails will begin sending to your targets.
  • Skip Weekends: Select if you don't want phishing emails to be sent over weekends. See the section Skip Weekends option below.
  • Spread: The spread specifies the period over which the phishing emails will be sent. Options are All at Once, Send over 1 Day, Send over Next 3 Days, Send over Next 5 Days, Send over Next 7 Days, Send over Next 14 Days, Send over Next 30 Days. If you choose to have the phishing emails sent over a selected period, for example, Send over Next 3 Days, different targets will receive the email each of the three days.
    Note: If you selected Skip Weekends, emails will not be sent on Saturday and Sunday.
  • Hours to Send: Time frame emails are sent each day.
  • Organizations & groups: The organizations and the groups within those organizations for which the phishing campaign applies.
  • Frequency: This is the rate at which the phishing emails will be sent. Options are Once, Weekly, Biweekly, Monthly, and Quarterly. If Once is selected, only one phishing kit can be selected for the campaign. For the other frequencies, additional kits can be added. For example, select Monthly and one kit can be added for each month included in the campaign.
  • Kit: A kit comprises the content of the phishing email, the sending profile, and the landing page the user is taken to if the user clicks the phishing link in the email. A campaign can include one or more kits.
  • Delivery Date: This is the date the emails will be delivered.

Skip Weekends option

When the Skip Weekends option is selected, phishing campaign emails will not be sent over the weekend if the selected spread includes Saturday and Sunday. For example, a campaign is scheduled to start on Thursday August 1, 2024 and Send over Next 7 Days is selected for the Spread. Therefore, campaign emails will be sent on Thursday August 1, Friday August 2, Monday August 5, Tuesday August 6, and Wednesday August 7.

If you schedule a campaign to start on a weekend and Skip Weekends is selected, the campaign start date is moved to Monday. Consider an example where a phishing campaign is scheduled to start on Saturday August 3, 2024. The campaign start date will be moved to Monday August 5, 2024. The results for each Spread in this scenario are as follows:

  • All at Once: All emails sent Monday August 5.
  • Send Over 1 Day: All emails will be sent on Monday.
  • Send over the Next 3 Days: Emails will be sent on Monday, Tuesday, and Wednesday.
  • Send over the Next 5 Days: Emails will be sent on Monday, Tuesday, Wednesday, Thursday, and Friday.
  • Send over the Next 7 Days: Emails will be sent on Monday, Tuesday, Wednesday, Thursday, and Friday.
  • Send over the Next 14 Days: Emails will be sent on Monday, Tuesday, Wednesday, Thursday, and Friday during the weeks of August 5 and August 12.
  • Send over the Next 30 Days: Emails will be sent on Monday, Tuesday, Wednesday, Thursday, and Friday during the weeks of August 5, August 12, August 19, and August 26. Emails will also be sent Monday September 2 and Tuesday September 3.

Campaign attribute examples

The table below includes examples demonstrating the relationship between key phishing campaign attributes. Delivery Date is based on the selected Campaign Start Date, Spread, Frequency, and the number of kits included.

Example Campaign Start Date Spread Frequency Number of kits included Delivery Date
1 01/29/24 All at Once Once One (maximum allowed 01/29/24
2 01/29/24 All at Once Weekly Three
  • Week 1: 01/29/24
  • Week 2: 02/05/24
  • Week 3: 02/12/24
3 01/29/24  Over Next 3 Days Weekly  Three
  • Week 1: 01/29/24 - 02/01/24
  • Week 2: 02/05/24 - 02/08/24
  • Week 3: 02/12/24 - 02/15/24

Example 1:

In the first example, All at Once is selected for the Spread, meaning the campaign emails will be sent to all targets at the same time. Once is the selected Frequency and therefore, this campaign can include one kit only. The Campaign Start Date is 01/29/24 and all campaign emails will be delivered on that date.

Example 2:

In the second example, All at Once is selected for the Spread. Weekly is the selected Frequency and therefore, this campaign can include up to 52 kits. Three kits have been included in this campaign. Hence, a campaign email will be sent each week for three weeks, each including the kit selected for the given week. Each week, the campaign emails will be sent to all targets at the same time per the Delivery Date.

Example 3:

In the third example, Over Next 3 Days is selected for the Spread. Weekly is the selected Frequency. Three kits have been included in this campaign. Hence, a campaign email will be sent each week for three weeks, each including the kit selected for the given week. While all targets receive an email each week, because Over Next 3 Days is selected for the Spread, the campaign emails will be sent to different targets each of the three days within each week.

How to...

  1. In the navigation menu, select Phishing Simulation > Create Phishing Campaign.

  2. Enter Campaign Details:
    1. Campaign Name: Enter a name for your campaign.
    2. Description: (Optional) You can enter a campaign description.
    3. Campaign Start Date: Indicates the date phishing emails will begin sending. The current date is prepopulated. Click the date to select a date from the calendar.
    4. Skip Weekends: (Optional) Select if you don’t want the phishing emails to be sent over weekends.
    5. Spread: Select the period over which the phishing emails will be sent.
      • If you select All at Once, select a Start Time.
      • If you select any other option, select a start and end time.
  3. Click Next.
  4. Enter Recipients information:
    1. Organizations: Select the organization(s) for which the campaign is being created.
      Note: You can select more than one organization.
    2. Groups: Select the group to which the campaign will be sent.
    3. Time Zone: Select the applicable time zone.
  5. Click Next.
  6. Enter Kit Selection information:
    1. Frequency list: Select the rate at which the phishing emails will be sent.
    2. Drag and drop the desired phishing kit to the Drag & Drop area.

      Note: The Active Until date represents the campaign’s close date. It is always three days after the last Delivery Date.
    3. If desired, drag and drop additional phishing kits.

  1. Click Next.
  2. Review the campaign information.
  3. If you want to make changes, click the pencil icon next to the desired section. After making the applicable edits, click the Next button until the Review Campaign page is displayed again.
  4. On the Review Campaign page, click Confirm.
  5. The campaign is created on the Phishing Dashboard and a confirmation message is displayed.

To edit, cancel, or delete a campaign, it must be in one of the following statuses:

  • Edit: Scheduled
  • Cancel: Scheduled, Sending Emails, Running
  • Delete: Scheduled, Sending Emails, Running, Completed, Cancelled
  1. In the navigation menu, select Phishing Simulation > View All Campaigns.

  2. To edit a campaign:
    Note: You cannot edit the Frequency.
    1. On the Phishing Dashboard page, do one of the following:
      • Click the name of the desired campaign.
      • In the last column, click the View icon.
    2. In the upper-right corner of the campaign’s Details page, select Actions > Edit.

    3. On the Edit Phishing Simulation Campaign page, make the desired edits.
    4. In the lower-right corner, click the Update button.
  3. To cancel a campaign,
    1. On the Phishing Dashboard page, select the check box of the desired campaign.
    2. Above the table, click Cancel.
    3. In the confirmation modal, click OK. The campaign’s Status column indicates Cancelled.

NOTE  Another option for cancelling a campaign is to click the View icon in the last column and select Actions > Cancel.

  1. To delete a campaign:
    1. On the Phishing Dashboard page, do one of the following:
      • Click the name of the desired campaign.
      • In the last column, click the View icon.
    2. In the upper-right corner of the campaign’s Details page, select Actions > Delete.
    3. In the Confirmation modal, type Delete and click the Delete button.

 

Tutorial: How to Create a Phishing Campaign

 

Revision Date posted

Added tutorial video.

8/23/24