Jul 27, 2025 12:50 PM
(This post was last modified: Jul 27, 2025 01:00 PM by thecrowsec.)
Hey security folks 👋,
I'm excited to announce the beta release of Metaphish — a powerful phishing platform built from the ground up to outperform GoPhish and meet the needs of modern red teamers, security awareness managers, and threat simulation teams.
⚙️ What is Metaphish?
Metaphish is a client-server phishing framework that supports:
🧪 Realistic multi-channel phishing (Email, SMS, Voice)
🚦 Campaign modes (Live, Testing)
💡 Advanced spoofing & evasion features
📊 Real-time tracking, reporting, and target validation
🧪 Beta-Ready Features
🗂 Campaign Modes
Live – Production-ready campaigns against real targets
Testing – Safe testing mode for QA, internal review, or payload trials
📞 Multi-Channel Campaign Types
Phishing – Email-based, pixel tracked, and redirect capable
Smishing – SMS delivery with dynamic link shortening and tracking
Vishing – Voice campaigns with audio prompts and call tracking (via external integration)
💣 Delivery & Obfuscation Features
📧 Sender Rotation
Rotate From, Reply-To, and envelope senders to improve delivery and avoid detection
🧪 Subject Rotation
A/B test subject lines to improve engagement and simulate real-world phish variability
💉 Body Poisoning
Obfuscate key phrases
Embed junk HTML/CSS for spam filter evasion
Dynamic payload injection per recipient
✍️ Template Editor (Powerful & Flexible)
Visual HTML editing
Real-time rendering preview
Dynamic variables ({{first_name}}, {{role}}, {{track}} etc.)
Custom X-Headers and MIME header injection
✅ Target & SMTP Validation
Email Score Validation
MX & domain checks
Syntax & format scanning
Deliverability scoring
SMTP Configuration Checks
Validate SPF, DKIM, and DMARC
Auto-check blacklists and open relay issues
Per-campaign mail server diagnostics
📈 Tracking & Campaign Intelligence
📍 Pixel Tracking – Monitor email opens, geolocation, device metadata
🔗 Entry/Exit Redirects – Redirect chain simulation (e.g., link → fake login → training portal)
📊 Analytics Dashboard – Engagement heatmaps, click maps, per-user reporting
🔐 Access & Architecture
Client-Server Model
Audit Logging for compliance & traceability
REST API for full automation and platform integration
🛠 Tech Stack
Backend: Node.js (Express + custom modules)
Frontend: React + Tailwind
Database: PostgreSQL
Deployment: Docker-ready, K8s-compatible
👥 Now Accepting Beta Testers
We're currently onboarding a limited number of beta testers to help shape the future of Metaphish.
✅ Test real campaigns
✅ Report bugs, suggest features
✅ Priority support and early access to future modules
Screenshots
xttps://ibb.co/396V2zCB
xttps://ibb.co/hRKp7nTD
xttps://ibb.co/Rp6GMCVm
xttps://ibb.co/TBX40JXj
I'm excited to announce the beta release of Metaphish — a powerful phishing platform built from the ground up to outperform GoPhish and meet the needs of modern red teamers, security awareness managers, and threat simulation teams.
⚙️ What is Metaphish?
Metaphish is a client-server phishing framework that supports:
🧪 Realistic multi-channel phishing (Email, SMS, Voice)
🚦 Campaign modes (Live, Testing)
💡 Advanced spoofing & evasion features
📊 Real-time tracking, reporting, and target validation
🧪 Beta-Ready Features
🗂 Campaign Modes
Live – Production-ready campaigns against real targets
Testing – Safe testing mode for QA, internal review, or payload trials
📞 Multi-Channel Campaign Types
Phishing – Email-based, pixel tracked, and redirect capable
Smishing – SMS delivery with dynamic link shortening and tracking
Vishing – Voice campaigns with audio prompts and call tracking (via external integration)
💣 Delivery & Obfuscation Features
📧 Sender Rotation
Rotate From, Reply-To, and envelope senders to improve delivery and avoid detection
🧪 Subject Rotation
A/B test subject lines to improve engagement and simulate real-world phish variability
💉 Body Poisoning
Obfuscate key phrases
Embed junk HTML/CSS for spam filter evasion
Dynamic payload injection per recipient
✍️ Template Editor (Powerful & Flexible)
Visual HTML editing
Real-time rendering preview
Dynamic variables ({{first_name}}, {{role}}, {{track}} etc.)
Custom X-Headers and MIME header injection
✅ Target & SMTP Validation
Email Score Validation
MX & domain checks
Syntax & format scanning
Deliverability scoring
SMTP Configuration Checks
Validate SPF, DKIM, and DMARC
Auto-check blacklists and open relay issues
Per-campaign mail server diagnostics
📈 Tracking & Campaign Intelligence
📍 Pixel Tracking – Monitor email opens, geolocation, device metadata
🔗 Entry/Exit Redirects – Redirect chain simulation (e.g., link → fake login → training portal)
📊 Analytics Dashboard – Engagement heatmaps, click maps, per-user reporting
🔐 Access & Architecture
Client-Server Model
Audit Logging for compliance & traceability
REST API for full automation and platform integration
🛠 Tech Stack
Backend: Node.js (Express + custom modules)
Frontend: React + Tailwind
Database: PostgreSQL
Deployment: Docker-ready, K8s-compatible
👥 Now Accepting Beta Testers
We're currently onboarding a limited number of beta testers to help shape the future of Metaphish.
✅ Test real campaigns
✅ Report bugs, suggest features
✅ Priority support and early access to future modules
Screenshots
xttps://ibb.co/396V2zCB
xttps://ibb.co/hRKp7nTD
xttps://ibb.co/Rp6GMCVm
xttps://ibb.co/TBX40JXj
![[Image: 9428137.gif]](https://i.postimg.cc/Ghyw1KPs/9428137.gif)