Overview
Double-barrel phishing is a two-message simulation designed to show how an attacker can build trust before making a malicious request. The first message is the lead: a short, believable note such as “How are you doing?” or “Are you available?” The second message is the bite: a related phishing message that asks the target to click a link, submit information, open an attachment, reply, or take another tracked action.
In the Portal, you can build this scenario with two phishing email templates and the Collate Templates feature. Collation keeps the templates together so each target receives both messages as part of the same campaign.
Before you begin
- Prepare two Phishing Email Templates: one lead and one bite. You can create templates under Templates > Create Template or copy and edit templates from the Template Library.
- Give the templates descriptive names, such as Double Barrel - 1 - Lead and Double Barrel - 2 - Bite.
- Choose the target audience. This can be a standard group or a Failed Only group containing users who recently failed a phishing test.
1. Create the lead and bite templates
- Create the lead. Keep this message short and conversational. It should establish context without asking the target to perform a failure action. For example, ask whether the recipient is available or mention that a follow-up request is coming.
- Create the bite. Continue the same storyline and include the action you want to test (i.e., a reply to the bite, clicking the hook link, etc).
- Keep the scenario consistent. Use logically related sender details, subjects, wording, and branding so the second message feels like a natural follow-up to the first.
- Save both templates and test their content, links, landing pages, and sender information before using them in a campaign.
2. Create the phishing campaign
- Navigate to Tests/Campaigns > Create Campaign.
- Select Phishing Campaign.
- On the Schedule tab, enter a descriptive campaign name and select the group or groups you want to test.
- Configure the campaign to use recurring send type to send 2 emails per target. Choose a sending window that leaves an appropriate gap between the lead and the bite. A Scheduled or Timezone send type is useful when the messages should arrive during selected business days or in each target’s local time.
- Continue to the Templates step.
3. Select and collate the templates
- Add the lead template and the bite template to Templates Selected for the Test.
- Enable Collate Templates.
- Arrange or select the templates so the lead is first and the bite is second.
- Confirm that the campaign shows two selected templates for each test. Do not randomize the order unless that is part of the scenario.
4. Review and start the campaign
- Review the target groups, sending rate, start time, tracking period, selected templates, template order, and domains.
- Confirm that each target will receive two messages and that the lead will be delivered before the bite.
- Complete any required domain authorization or safelisting steps.
- When everything is correct, click Finish to schedule the campaign.
Targeting users who recently failed
A double-barrel campaign can also be used as a focused follow-up for higher-risk users. Select a Failed Only group that contains targets who recently failed a phishing test, then use that group in the Campaign Wizard. This limits the campaign to the users who need additional testing instead of sending it to the entire organization.
If the selected group is maintained automatically and you want its membership to continue updating, leave individual Target Selection off. Turning Target Selection on creates a fixed selection and prevents Smart Sync from adding or removing targets from the test.
Recommendations
- Keep the lead harmless and free of tracked failure actions so results reflect only reply-to engagement with the bite.
- Use a realistic delay. Sending the bite immediately may make the simulation easier to identify.
- Use a Pilot campaign for internal validation when you do not want actions to affect account, group, or target metrics.
- After the campaign begins, review Tests/Campaigns > Manage Tests > Test Details to monitor delivered and opened emails, clicked links, data extended, replies, reports, and pass/fail results.
- Document which message produced each action so you can distinguish engagement with the lead from failure on the bite.