aiphish is a deepfake phishing simulation framework designed to test your company's resilience against emerging phishing threats. In the current threat environment, AI powered phishing campaigns that clone executive teams' likeness and run autonomously against your entire organization, are cheap and easy to deploy. aiphish aims to simulate this emerging threat. Either deploy it as a training and awareness tool or give your red team the tools real threat actors are using.

However you want, but we pronounce it Ay-phish.

aiphish is designed to be a phishing compatibility layer between an AI stack and a conference platform. It uses an adapter style architecture to allow you to plug-in your tools of choice. aiphish self-hosted ships with adapters for common LLMs and TTS providers (local and cloud) and common conferencing platforms. Additionally, the documentation provides guides on how to make your own adapters.

The core services are also available as separate containers to match different deployment needs. Whether that's isolating the app services or scaling Wraiths horizontally. Each phishing assessment is run by a containerized wraith which can either be deployed by a local runner service or through cloud provider adapters. Check the docs to see what cloud providers are currently supported as well as guides for building your own adapters.

Wraiths represent cloned identities that you assign to a campaign. During campaigns wraith agents deploy as containerized services joining a conference call with the target.

Both versions contain the same features; however, the self-hosted version will require you to set up your own AI, email, and conference call providers.

aiphish is a legitimate security tool designed to empower security teams to protect their organization by giving them the same tools threat actors are already using in the wild. By using aiphish, in any deployment form, you agree to our Acceptable Use Policy which explicitly prohibits targeting any individual, enterprise, organization, or entity, without their explicit, informed consent.

All open-source and source-available offensive security tools have the potential for misuse, which is why we have added additional guardrails to the platform. These include: an audit-compliant, expirable consent video that is used to create the deepfaked wraith, and ownership verification of all target domains.

No. Due to the potential for misuse, domain ownership must be verified before launching a campaign against it. Verification uses a standard DNS challenge (TXT record), similar to how you might register a Let's Encrypt certificate.

No. While we recognize that cloning an individual using videos and audio gathered from OSINT is a realistic attack vector, doing so has too much potential for misuse and runs afoul of deepfake laws in many jurisdictions.

All wraiths created with the aiphish platform require a consent video recording of the deepfake source reading a consent script. The consent script is then used to create the deepfake. Additional steps are taken to verify the consent file and ensure the dialog matches the consent script.

Please review our Acceptable Use Policy for more information.