Top 13 Public Phishing Tools in 2025

Phishing Frenzy 🎉

A web‑based campaign management framework historically used by penetration testers to organize phishing awareness campaigns, templates, and basic metrics. Legitimate when used in authorized security testing; illegal if used against people or organizations without consent.

Ghost Phisher 👻

A GUI toolkit often mentioned in community write‑ups about spoofing network services and captive portals. Helps defenders understand wireless and service‑spoofing attack vectors — again, only for authorized tests.

King Phisher 👑

A campaign automation tool referenced for targeted phishing simulations and reporting. Useful conceptually for designing defensive phishing‑awareness programs; operational details are not shared here.

WiFiPhisher 📶

Associated with rogue Wi‑Fi/captive‑portal social‑engineering scenarios. Understanding its concept helps defenders detect and mitigate rogue access points and captive‑portal attacks.

• GoPhish 🚀

  Often described as a simpler platform for running phishing simulations within an organization (when authorized). It’s commonly compared with commercial awareness platforms — descriptions only here.

• Zphisher ⚡️

  A community‑created script-style project cited in hobbyist/testing contexts. Good to know about from a defender’s perspective so you can recognize common phishing lures and patterns.
  

BlackPhish 🖤

A community project seen in public repositories; flagged in discussions about dual‑use tools. Use knowledge of such tools only to inform defensive controls and policies.

OhMyQR 🤳

Projects like this illustrate QR‑code based phishing scenarios (QR→link lures). Defenders should educate users about scanning unknown QR codes and previewing links before opening.

SayCheese 📸

Mentioned as a proof‑of‑concept for camera‑capture or unexpected device access. Emphasizes the importance of app permissions, privacy settings, and user consent.

I‑See‑You 👀

Similar to other camera/surveillance demos; underscores privacy risks and the need to lock down camera/microphone permissions and monitor app behaviors.

Social‑Engineer Toolkit (SET) 🛠️

A historically well‑known red‑team framework referenced in security training and defensive research. Useful to know about for defensive threat modeling — operational steps are excluded.

Evilginx 😈

Often discussed as a proxy‑style tool used in advanced session‑capture scenarios. From a defender’s viewpoint, it highlights why strong session protections, secure cookies, and MFA are critical.

SocialFish 🐟

A community project commonly used to demonstrate social‑login/credential harvesting techniques in controlled demos. Learn about it only to improve detection and user training.