Gophish-NG is an actively maintained and modernized fork of the original Gophish open-source phishing toolkit. While the upstream project has seen stagnant development, this version prioritizes security hardening, dependency modernization, and the inclusion of enterprise-level features required by modern red teams and security awareness operators.
Key Features
- Modernized toolchain using Go 1.25+ and esbuild for a more secure and efficient build process.
- Hardened codebase with specific fixes for XSS, SSRF, and authorization bypasses present in the upstream repository.
- Multi-user support allowing operators to collaborate on campaigns and share assets within defined teams.
- OAuth 2.0 support for IMAP reporting, enabling integration with modern mail providers like Microsoft 365.
- Anonymous campaign mode that scrubs recipient data to comply with strict privacy regulations and GDPR requirements.
- Advanced delivery controls including per-profile send rates and SMTP CC support.
Use Cases
- Red Team Operations: Executing sophisticated, large-scale phishing simulations with collaborative team access and shared infrastructure.
- Security Awareness Training: Developing and tracking employee response to tailored social engineering lures through a single web UI.
- Compliance-Driven Testing: Performing phishing engagements in jurisdictions requiring the anonymization of user interaction data for reporting.
