Learn how to create an SMS phishing (smishing) campaign from scratch on the GNSAC Phishing platform. This guide is designed for beginners.
An SMS campaign (smishing test) allows you to test security awareness by sending fake SMS messages to your employees. It works similarly to email campaigns, but is conducted via SMS.
An SMS profile determines which service provider your messages will be sent through. Twilio is the most popular option and can send SMS to almost any country. Other options: Vonage (Nexmo), AWS SNS, MessageBird, and Generic HTTP API.
| Field Name | Description | Example |
|---|---|---|
| Profile Name | The name you want to give the profile. Only you will see it. | Twilio Main Account |
| Provider Type REQUIRED |
Select your SMS provider:
|
Twilio |
| Sender Phone Number REQUIRED | The phone number SMS will be sent from. Number from your provider. Enter in international format (+1...) | +15551234567 |
| Rate Limit | Maximum number of SMS per minute. Set to avoid exceeding your provider's limits. | 60 |
Twilio is the most preferred SMS provider. Follow the steps below to create a Twilio account and connect it to GNSAC.
| Twilio Field | Where to Find? | Example |
|---|---|---|
| Account SID | Twilio Console > Account Info (starts with AC) | ACxxxxxxxxxxxxxxxx |
| Auth Token | Twilio Console > Account Info > Click "Show" | xxxxxxxxxxxxxxxx |
On a free trial account, you can only send SMS to verified numbers. For bulk SMS, you need to upgrade your account. Trial accounts add "Sent from Twilio trial account" at the beginning of each SMS.
An SMS template is the content of the message that will be sent to target users. It should be short, attention-grabbing, and contain a clickable link. Unlike email templates, SMS messages are limited to maximum 160 characters (1 segment). Longer messages are sent as multiple segments and cost more.
{{.URL}} variable!You can use the following variables in your SMS content. The system automatically replaces these with the correct value for each target.
| Variable | Description | Example Output |
|---|---|---|
| {{.FirstName}} | Target's first name | John |
| {{.LastName}} | Target's last name | Smith |
| {{.URL}} | REQUIRED! Phishing link. Must be used! | https://xyz.com/r/abc123 |
| {{.Position}} | Target's position | Engineer |
The SMS content must include {{.URL}} variable. Without it,
users cannot be redirected to the phishing page and the campaign will fail!
For SMS campaigns, phone number is required in target groups. You can use the same groups as email campaigns, but users must have phone numbers defined.
Enter phone numbers in international format:
+15551234567 (no spaces, no dashes).
The system may not automatically correct different formats.
Users without phone numbers in the target group will not be included in the SMS campaign. Check how many users have phone numbers in your group before launching the campaign.
When creating an SMS campaign, you select the SMS Profile, SMS Template, and Target Group you prepared in previous steps. You also specify the landing page URL and send time.
| Field | Description | Example |
|---|---|---|
| Campaign Name | Campaign name. Shown in reports with this name. | 2024-Q1 SMS Test |
| Landing Page URL CRITICAL! | Very important! The address that will replace {{.URL}} variable in SMS. Must be your GNSAC server's externally accessible address. | https://test.company.com |
| SMS Template | SMS template to be sent. | Bank Verification SMS |
| Sending Profile | SMS provider profile (Twilio, etc.) | Twilio Main Account |
| Landing PageOptional | Landing page defined in GNSAC. If left empty, URL field address is used. | - |
| Target Groups | Target group(s) to receive SMS. You can select multiple. | IT Department |
| Launch Date | Date/time for campaign launch. Empty = starts immediately. | 2024-03-15 09:00 |
After the campaign launches, you can track live from the "SMS Campaigns" page:
If you need assistance with anything, you can reach us at support@gnsac.com.tr.