Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
ShadowPhish — ShadowPhish is an advanced APT awareness toolkit designed to simulate real-world phishing, malware delivery, deepfakes, smishing/vishing, and command & control attacks through an intuitive graphical interface. Perfect for cybersecurity training, red team education, and security awareness programs. | Kitploit
Tools/GitHubGitHub/joasasantos/shadowphish
Penetration Testing FrameworksPhishing ToolsExploit FrameworksPayload GenerationPhishingMalware AnalysisCommand and ControlSocial EngineeringLearning & EducationRed TeamingPayload DevelopmentRepository Deleted
24630471 year agoReviewed by Kitploit
GitHubjoasasantos/shadowphish

ShadowPhish

The upstream repository was not found during the latest Kitploit update check. This listing remains available for reference, but it has been removed from search results.

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →

About

ShadowPhish is an advanced APT awareness toolkit designed to simulate real-world phishing, malware delivery, deepfakes, smishing/vishing, and command & control attacks through an intuitive graphical interface. Perfect for cybersecurity training, red team education, and security awareness programs.

Share

🕵️‍♂️ ShadowPhish - APT Awareness Toolkit

Version: 1.0
Author: Joas A Santos

Visual simulator for cybersecurity awareness, phishing, and APT-based social engineering.

image


🔥 Features

  • ✅ Malicious PDF generator
  • ✅ Word macro with remote shellcode
  • ✅ PowerShell obfuscation (Base64, IEX, compression, variables)
  • ✅ Remote VBS + embedded HTTP server
  • ✅ Prebuilt phishing websites (.sites/)
  • ✅ Fake Recaptcha (PasteJack style)
  • ✅ Deepfake video (FaceFusion) and DeepVoice TTS
  • ✅ Payload generator for Windows, Linux, macOS
  • ✅ Built-in reverse shell listener with command interface
  • ✅ APT Chains (APT29, APT41, FIN7)
  • ✅ Smishing (SMS) and Vishing (voice call via Twilio)
  • ✅ Malicious LNK shortcut builder
  • ✅ HTML Smuggling generator (Base64 embedded)
  • ✅ Simulated Ransomware + Decryptor
  • ✅ QR Code phishing generator

⚙️ Requirements

  • Python 3.10+
  • PHP (for phishing sites)
  • GCC / MinGW
  • ffmpeg + facefusion
  • Internet access (for DeepVoice and APIs)

Install dependencies:

root@kitploit:~
pip install -r requirements.txt

🚀 How to Run

root@kitploit:~
python main.py
  • Animated splash screen will appear
  • Choose your language
  • Toolkit interface will load

📁 Project Structure

root@kitploit:~
.
├── main.py
├── backend/           # Main logic
├── frontend/          # Splash + language selector
├── .sites/            # Phishing templates
├── .fake-recaptcha/   # Fake Recaptcha pastejack
├── outputs/           # Generated files
├── i18n/              # Translations
└── requirements.txt

🚀 Future Work & Improvements

  • Multi-language support: Extend full translation coverage across all features and tooltips, with community-contributed language packs.
  • Integrated reporting system: Generate PDF/HTML reports from simulations for audits, training, or awareness tracking.
  • User role system: Introduce user roles (admin, operator, trainee) for multi-user environments.
  • Phishing campaign builder: Visual editor to simulate full phishing campaigns with delivery scheduling and tracking.
  • Cloud integration: Deploy phishing and payload simulations on isolated cloud environments for remote demonstrations.
  • EDR/AV evasion lab: Create a module that benchmarks payload detection across common security solutions.
  • Simulation scoring system: Automatically evaluate success or failure of simulated APT chains for gamification and training purposes.
  • Plugin SDK: Allow developers to create and integrate custom payloads, phishing templates, or attack vectors.

🙏 Credits

  • Developed by Joas A Santos
  • .sites/ templates inspired and adapted from Zphisher

⚠️ Legal Notice

This toolkit is strictly for educational and awareness purposes only.
Do not use in real environments without explicit authorization.


🕵️‍♂️ ShadowPhish - APT Awareness Toolkit

Versão: 1.0
Autor: Joas A Santos

Simulador visual para conscientização sobre APTs, phishing, engenharia social e ameaças cibernéticas.

image


🔥 Funcionalidades

  • ✅ Geração de PDFs maliciosos
  • ✅ Macros Word com shellcode remoto
  • ✅ PowerShell evasivo com opções de codificação, compressão e IEX
  • ✅ VBS remoto com shellcode + servidor embutido
  • ✅ Sites de phishing prontos (.sites/)
  • ✅ Recaptcha Falso (PasteJack)
  • ✅ Deepfake (FaceFusion) e DeepVoice (TTS)
  • ✅ Geração de Payload C2 para Windows, Linux e macOS
  • ✅ Terminal interativo com listener embutido
  • ✅ Cadeias de ataque APT29, APT41, FIN7
  • ✅ Smishing (SMS) e Vishing (ligação com áudio)
  • ✅ Gerador de LNK malicioso
  • ✅ HTML Smuggling (base64 + download automático ou por clique)
  • ✅ Simulador de Ransomware e Decryptor
  • ✅ Geração de QR Code malicioso

⚙️ Requisitos

  • Python 3.10+
  • PHP (para servidores de phishing)
  • GCC / MinGW
  • ffmpeg + facefusion (para deepfake)
  • Internet (para TTS, APIs)

Instale as dependências:

root@kitploit:~
pip install -r requirements.txt

🚀 Como usar

root@kitploit:~
python main.py
  • Uma splash screen será exibida
  • Selecione o idioma desejado
  • A interface principal será carregada

📁 Estrutura

root@kitploit:~
.
├── main.py
├── backend/           # Código principal
├── frontend/          # Splash + seletor de idioma
├── .sites/            # Templates de phishing
├── .fake-recaptcha/   # Recaptcha falso com payload automático
├── outputs/           # Arquivos gerados
├── i18n/              # Traduções em JSON
└── requirements.txt

🚀 Futuro & Melhorias

  • Suporte multilíngue: Expandir a cobertura de tradução para todas as funcionalidades e dicas, com pacotes de idiomas contribuídos pela comunidade.
  • Sistema de relatórios integrado: Gerar relatórios em PDF/HTML a partir das simulações para auditorias, treinamentos ou registros.
  • Sistema de perfis de usuário: Introduzir papéis como administrador, operador e aprendiz para ambientes multiusuário.
  • Construtor de campanhas de phishing: Editor visual para simular campanhas de phishing completas com agendamento de entrega e rastreamento.
  • Integração com nuvem: Possibilidade de simular phishing e cargas maliciosas em ambientes de nuvem isolados para demonstrações remotas.
  • Laboratório de evasão EDR/AV: Módulo que testa a detecção dos payloads em soluções de segurança populares.
  • Sistema de pontuação de simulação: Avaliação automática de sucesso ou falha das cadeias APT para gamificação e treinamentos.
  • SDK para Plugins: Permitir que desenvolvedores criem e integrem payloads, templates de phishing ou vetores de ataque personalizados.

🙏 Créditos

  • Desenvolvido por Joas A Santos
  • Templates .sites/ extraídos e adaptados do excelente projeto Zphisher

⚠️ Aviso Legal

Esta ferramenta é estritamente educacional, voltada para conscientização e simulações de segurança ofensiva.
Não utilize em ambientes reais sem autorização.