HACKING PROJECT · social · Advanced
AI Phishing & Social-Engineering Simulator
Safely emulate AI-personalized social-engineering campaigns to measure and reduce organizational human risk.
Organizations struggle to train employees against modern, AI-personalized social engineering because canned phishing templates are quickly recognized and don't reflect adversary tradecraft. Security teams need realistic, controlled simulation to measure human risk and drive targeted training. Without safe emulation, defenders underestimate exposure to spearphishing, pretexting, and multi-channel (email/SMS/voice) attacks.
**What you'll build**
Build a controlled red-team simulation platform that generates realistic (but clearly authorized and sandboxed) phishing and social-engineering scenarios using LLMs, with OSINT-informed personalization, campaign management, landing-page emulation, and click/report telemetry. Include strict guardrails, consent/scoping controls, and outcome analytics that feed adaptive training — emphasizing ethical, opt-in, defensive use.
**Objective** — Safely emulate AI-personalized social-engineering campaigns to measure and reduce organizational human risk.
**Expected outcome** — An authorized simulation platform with campaign builder, telemetry dashboard (click/report/credential-submit rates), and per-user risk scoring plus training assignment.
**Difficulty** — Advanced — combines offensive tradecraft, LLM integration, campaign infra, telemetry, and strict ethical/guardrail engineering.
**Primary category** — Penetration Testing / Social Engineering; Secondary = Security Awareness, AI/ML Security, Purple Team
**Security domains** — Primary = Red Team; Secondary = Purple Team, Security Research, AI Security, GRC (awareness)
**Technical focus** — Phishing simulation, pretext generation, OSINT-driven targeting, LLM prompt engineering & guardrails, landing-page emulation, campaign orchestration, click telemetry, human-risk scoring, consent/authorization controls
**Core technologies** — Languages: Python, JavaScript; Frameworks/Libraries: GoPhish (basis), Flask/FastAPI, LLM SDKs (with guardrails), templating engines; Security Tools: GoPhish, Evilginx (concept/awareness only, sandboxed), SET (reference); Cloud/Infra: isolated Docker/VM lab, mail infra, TLS; AI/Data: LLM for content generation, content-safety filters; Databases: PostgreSQL, Redis
**Where it's valued** — MSSPs/red-team consultancies, enterprise security teams, awareness-training vendors, finance/healthcare/government
**Careers it builds toward** — Red Team Operator, Penetration Tester, Social-Engineering Specialist, Security Awareness Engineer, Purple Team Engineer
**Framework alignment**
• MITRE ATT&CK: Phishing (T1566), Spearphishing Link (T1566.002), Spearphishing Attachment (T1566.001), Spearphishing via Service (T1566.003); Gather Victim Identity Info (T1589), Search Open Websites/Domains (T1593). MITRE ATLAS: adversarial use of GenAI for lure creation.
• NIST CSF 2.0: Identify (human-risk assessment), Protect (PR.AT training), Detect (measuring report rates)
• OWASP: LLM Top 10 — LLM01 Prompt Injection, LLM09 Misinformation, and content-safety/guardrail controls central to responsible design
• CIS Controls v8: Control 14 (Security Awareness and Skills Training), Control 9 (Email/Web Protections validation)
**Innovation** — Improved Existing Solution — GoPhish exists, but AI-personalized, OSINT-informed, guardrailed simulation with adaptive training is a strong commercial and portfolio differentiator. Scores: Innovation 7/10, Startup 8/10, Enterprise-Readiness 7/10, Patent = Possible.