> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/human-security/phishing.md). # Phishing simulation The Phishing simulation trains your employees to spot fraudulent emails, with a learning-by-doing approach: * Fake phishing emails are sent regularly (weekly, monthly, or quarterly) to train employees to identify fraudulent messages. * Employees who fall for a fake phishing email are automatically redirected to an awareness lesson. With this approach, 75% of employees who are caught out the first time do not fall for it again.

:gear:

Setup

Sync your employees and enable email delivery.Setup

:paper-plane:

Launching a campaign

Choose the rhythm, the audience and the templates.Launching a campaign

:envelope-open-text:

Templates

Use the prebuilt library or write your own emails.Templates

:chart-line:

Results and performance

Track opens, clicks and submitted credentials.Results and performance
## What is phishing Phishing is a fraudulent technique in which a cybercriminal sends an email impersonating a well-known third party (such as Google, Amazon, or Microsoft). Their goal is to trick the recipient into clicking a link or downloading a file in order to steal information, money, or install malware. ## Common phishing techniques
CEO fraud CEO fraud is a targeted scam in which an attacker impersonates a company executive (often the CEO or CFO) to deceive an employee into making a fraudulent banking transaction. **How it works** * Identity theft: the fraudster sends an email (or calls) impersonating a high-ranking employee within the company. * Emergency scenario: an urgent, confidential, and sensitive situation (an acquisition, a payment to a strategic supplier, a legal emergency, etc.). * Psychological pressure: the employee, usually from the accounting or finance department, is pushed to act quickly without following standard procedures. * Fraudulent transfer: the victim transfers money to an account controlled by the scammers, often located abroad. **Why it works** * The email appears credible (professional language, a very similar fake email address, the CEO's signature, etc.). * The targeted employee is often isolated, under pressure, or intimidated by management. * The attack is highly targeted: the fraudsters research the company, its executives, and its internal practices. **Consequences**: significant financial losses, reputational damage, legal liability if protections are not in place. **How to protect yourself** * Raise awareness among all employees, especially those in sensitive departments (finance, HR, etc.) * Implement a strict internal validation procedure for transfers * Activate technical protections: SPF, DKIM, DMARC, anti-spoofing filters * Systematically verify any unusual request through a secondary channel (phone, video conference, in person) To test your team against this attack, see [Payment Fraud Simulation](/human-security/advanced/payment-fraud-setup.md).
Credential theft * You receive an email that creates a sense of urgency: an unexpected expense, a suspended account, a password change. By impersonating a known third party, the attacker tries to make you click a link that redirects you to a fraudulent website. * You enter your credentials on the website and the attacker obtains them: the website looks legitimate, but belongs to the attacker. * You don't realize you've been attacked: you see an "Incorrect credentials" screen and are redirected to the legitimate website, so the next login works.
Malicious attachments This attack is more sophisticated and less frequent. It lets the attacker take control of an employee's workstation, the entry point to the company's IT system. The attacker tricks you into downloading a PowerPoint, Excel, or Word document and enabling macros, either by email or through a file transfer platform. Once the macros are enabled, the attacker controls the workstation.
## Best practices When an email asks you to download an attachment, make a transfer, or enter a password, be vigilant: * **Check the sender's domain name.** The address may look familiar but be spoofed. Look at the part after `@`: if it doesn't match the real sender letter for letter, it's a phishing attempt. * **Check the domain name of any website you are redirected to.** A fake website controlled by the attacker does not have the same address (URL) in your browser's address bar. * **Verify through another channel.** Ask the sender for confirmation by SMS, through customer service, or by going directly to the website in your browser. To limit the risk: * **Raise awareness**: 73% of cyberattacks originate from phishing an employee (CESIN). * **Enable two-factor authentication (2FA)**: stolen credentials are not enough to impersonate a user who has a second factor. * **Use a password manager**: it checks the domain name of websites asking for credentials, and fills nothing in on a fake one. ## If an employee falls for it If the employee entered credentials: * Change the password of the compromised account, and of every other service that uses the same (or a similar) password. * Enable two-factor authentication on the compromised account. * Notify Stoïk so we can check that the attacker has not left another way back in. If the employee downloaded a malicious attachment: * Turn off the device to limit the spread. * Notify Stoïk so we can remove the malware and check that it has not spread. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.stoik.io/human-security/phishing.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.