darkmailr is a self-hosted, offline phishing simulation tool that uses open-source LLMs (via Ollama) to generate realistic, context-aware phishing emails for red team exercises, security awareness training, and prompt injection testing.
Important: This tool is for educational and authorized testing purposes only. Users are solely responsible for ensuring compliance with all applicable laws and regulations.
curl -fsSL https://ollama.com/install.sh | sh
ollama run mistral # Or any other model that runs on Ollama
ollama serve &
git clone https://github.com/darkmailr/darkmailr.git
cd darkmailr
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
python app.py
In darkmailr’s UI, you first fill in the sender information, like sex, name, company, etc.
Then you fill in the receiver information, topic of the phishing email, choose the attack vectors — phone number, web link, and/or attachment —, and click on “GENERATE PHISHING EMAIL”.
After some time, which depends on the processing power of your server machine, darkmailr outputs a phishing email based on your input.
Quite convincing, I think.
Edit app.py
and modify the model name:
"model": "mistral", # Change to: llama2, codellama, etc.
Modify the prompt template in app.py
:
prompt = f"""Your custom prompt template here..."""
darkmailr is an open source project and the first version has just been released. Contributions to improve and further develop the tool are highly welcome. Please see the CONTRIBUTING.md for guidelines.