Target Selection in Phishing: Considerations and Strategies

In the realm of phishing, target selection lies at the core of every successful campaign. This practice involves identifying individuals or groups within an organization whose interaction with a phished email can yield the greatest returns. The art and science of this process distinguish a high-yield attack from one that simply raises suspicion. By understanding how attackers choose their targets, red teamers can design simulations that expose vulnerabilities in an organization’s security awareness training without alerting all personnel to the ongoing exercise.

After engaging with this material, you’ll be equipped to strategically select the highest-value targets for phishing campaigns by considering factors such as psychological triggers, role significance, and specific vulnerabilities tied to industries or companies. Furthermore, you’ll learn to employ tools for gathering information that can be leveraged in crafting believable and effective phishing emails that maximize engagement.

Prerequisites and Setup

Before you embark on a phishing campaign, you’ll need to gather a comprehensive toolkit to aid your efforts. Start with GoPhish, a powerful tool for deploying phishing simulations. Install this on a Linux environment using the following command:


sudo apt-get install gophish

This command installs GoPhish, providing a platform for crafting phishing emails and managing campaigns.

OSINT tools are also critical, as they help in gathering necessary information about potential targets. Tools like theHarvester and Maltego assist in harvesting email addresses and social profiles, while LinkedIn serves as a goldmine for organizational role mapping. Install theHarvester with:


git clone https://github.com/laramies/theHarvester.git && cd theHarvester && sudo python3 setup.py install

This setup command clones the theHarvester repository and installs it, enabling you to commence data collection immediately.

Finally, access a VPS for domain spoofing and email relay configurations. Services like DigitalOcean or AWS provide easy setup options. Ensure your domain mimics legitimate services closely enough to deceive targets, utilizing homographs or subtle typosquats.

Step-by-Step Execution

Harvesting Target Data

1. Leveraging LinkedIn

LinkedIn is invaluable for identifying key employees, from executives to IT administrators. Focus on those who publicly display responsibilities involving high-level decision making or access to sensitive data. Create an account solely for reconnaissance and ensure your network reaches employees within the targeted organization.

Bypass direct inquiries; instead, join relevant professional groups to observe inter-organizational dynamics and jargon, enhancing the realism of your later exploits.

2. Using theHarvester

With your targets identified, use theHarvester to cross-reference and expand your list of reachable emails:


theHarvester -d targetcompany.com -b linkedin

TheHarvester command to extract emails from LinkedIn for targetcompany.com, augmenting your phishing list.

3. Email Verification and Enrichment

Enhance your dataset using email verification APIs like Hunter or VerifyEmailAddress. Securely check which emails are valid, supplement them with additional OSINT, and match against your initial LinkedIn findings to ensure campaign reach.

Crafting Convincing Lures

1. Psychological Anchors

Craft emails that tap into everyday concerns. For instance, an urgent security update request can exploit an employee’s fear of account compromise:


Subject: Immediate Action Required: Security Update Notification



Dear [Name],



Your user account has shown suspicious activity and will be locked if not verified within 24 hours. To ensure continuous access, confirm your identity by visiting the link below.



[Link to phishing page]



Best regards, 

IT Security Team

Draft of an email leveraging urgency and authority to capture attention and compel swift action.

2. Mimicking Legitimate Sources

Deploy SPF and DKIM records to increase email deliverability and legitimacy. Spoof addresses in a way that makes detection difficult, such as using mícrosoft.com or appending familiar domains with a known but different TLD like login.microsoft.account-updates.com.

Deploying and Monitoring Campaigns

1. Launching with GoPhish

Set up GoPhish campaigns to send phishing emails, track openings, clicks, and credential submissions. Configure your GoPhish campaign as follows:


gophish -t campaigns -p 80

Command to start GoPhish on the default HTTP port to manage your phishing campaigns and track their effectiveness.

2. Analyzing Campaign Metrics

Use the GoPhish dashboard to monitor engagement metrics. Analyze gathered data for trends that can inform future targeting decisions and improve simulation statistics. Emphasize successful engagements by specific role or department for sharper future focus.

Advanced Variations

1. Industry-Specific Phishing Themes

Create lures tailored to industry practices or recent news. Healthcare breaches might include fabricated emails from medical board examinations, while financial services can incorporate fake security compliance checks. These themes resonate more with your target’s daily reality, thereby enhancing credibility.

2. Layered Attacks

Combine spear-phishing with other attack vectors for greater complexity. This can include Vishing (voice phishing) where a preceding or following call can affirm legitimacy to the target. These combinations encourage higher trust in the fraudulent communication.

3. Deepfake Enhancement

Utilize AI to synthesize audio or visual components, such as a fake video update from a supposed company leader, if appropriate. This novel tactic substantially amplifies the gravitas of an otherwise standard phishing attempt, drastically boosting click-through rates and effectiveness.

Good / Better / Best

Good: Basic mass email with a plausible subject line and body text but generic messaging—functional yet easily suspect.
Better: Incorporates role-specific jargon and customized sender identity to resonate more sincerely—contextually convincing but detectable with caution.
Best: Uses deep insights from OSINT and industry specifics to craft personalized content tailored to emotional and organizational nuances—appears as a normal workflow element, highly deceptive to seasoned practitioners.

Related Concepts

Consider the role of Open Source Intelligence (OSINT) in amplifying your target selection strategy. OSINT not only aids in target identification but also enriches the context needed to craft highly effective phishing narratives. Explore similar tactics in our Framework sub-category on Social Engineering to further enhance your targeting acumen.