Phishing Simulation Automation with OpenAI and Google Sheets Tracking - n8n Workflow

Chief Information Security Officers (CISOs)
Internal Red Teams or Security Operations Centers (SOCs)
HR and Training departments looking to automate security awareness programs.
System administrators seeking advanced, measurable n8n templates for compliance.

This comprehensive n8n workflow, dubbed 'RedOps Module 1 – PhishForge,' is designed for internal security training. It provides a highly automated, measurable solution for conducting phishing simulations without requiring expensive third-party tools. The key value of this n8n automation lies in its integration with OpenAI, which ensures the generated phishing content is contextually relevant and highly deceptive, maximizing the effectiveness of the training exercise. Every stage, from pulling the target list via a Google Sheets n8n node to logging successful clicks, is managed within this single, efficient n8n workflow. The output helps security teams immediately identify and prioritize employees needing targeted training based on concrete data recorded in Google Sheets.

The entire process is initiated by the Manual n8n trigger, making it an on-demand operation for security teams.

1. Target Acquisition: The n8n workflow begins by using a Google Sheets n8n node (GetTargetList) to fetch the email addresses of the employees targeted for the simulation.


2. AI Content Generation: For each target, the n8n node using LangChain Agent and the connected OpenAI Chat Model dynamically generates a highly realistic and customized phishing email body and subject line.


3. Email Formatting and Tracking: The Set n8n node (✉️ Format Email for Sending) takes the AI output and structures it into a proper email format. Crucially, it embeds a unique Webhook URL, which serves as the tracking link for the phishing attempt.


4. Delivery and Logging: The Gmail n8n node sends the crafted email. Immediately afterward, a Google Sheets n8n node (🧾 Log Sent Email) records the details of the sent communication for audit purposes.


5. Click Monitoring: The Webhook n8n node (🎯 Click Tracker) is the dedicated listener. If a user clicks the tracking link in the simulated phishing email, this n8n trigger is activated, capturing data about the click event.


6. Recording Failure: A subsequent Set n8n node processes the webhook data, and the final Google Sheets n8n node (🧾 Record Click) logs the user who clicked the link, automatically flagging them for mandatory security awareness training.

To deploy this powerful n8n workflow, follow these steps:

1. Import: Copy the raw JSON data for this n8n templates file and import it directly into your n8n instance.


2. Credentials Setup: You must configure credentials for the following services:

1. Webhook Configuration: After importing, navigate to the Webhook n8n node (🎯 Click Tracker). Save the workflow to generate the unique Test and Production Webhook URLs. You must ensure this Production URL is correctly referenced and embedded within the link generation logic in the '✉️ Format Email for Sending' n8n node.


2. Google Sheets Preparation: Ensure you have two Google Sheets ready: one containing the list of target employees, and a second sheet for logging the results (sent emails and click events).


3. Execution: Once credentials and sheet details are configured in the respective n8n node parameters, execute the n8n workflow manually.

This n8n workflow utilizes several specialized and core n8n nodes to achieve its complex logic:

Manual Trigger n8n trigger: The starting point, used to execute the n8n workflow manually for controlled simulations.
Google Sheets (GetTargetList) n8n node: Action: Read data (Target List). Key Configuration: Specifies the Spreadsheet ID and range containing the employee email list.
LangChain Agent (🤖 Generate Phishing Email) n8n node: Function: Acts as the orchestration layer, utilizing the connected AI model to write the deceptive email content based on defined security prompts.
OpenAI Chat Model n8n node: Function: Provides the large language model capability for text generation, integral to creating realistic simulation emails.
Set (✉️ Format Email for Sending) n8n node: Function: Maps the dynamic AI output and combines it with a static Webhook URL to create the final, tracked email structure for the Gmail n8n node.
Gmail n8n node: Action: Send Email. Function: Delivers the fully constructed phishing email to the recipient list.
Google Sheets (🧾 Log Sent Email) n8n node: Action: Append Data. Function: Logs audit records for every email successfully sent by the Gmail n8n node.
Webhook (🎯 Click Tracker) n8n trigger: Function: Serves as the unique tracking endpoint. It's the mechanism that notifies the n8n workflow when a simulated malicious link has been clicked.

• Google Sheets (🧾 Record Click) n8n node: Action: Append Data. Function: Records the identity and timestamp of the employee who failed the simulation, facilitating timely intervention and training.