Before launching a campaign, you may need to modify a scenario. You must first complete the scenario details, then edit the phishing email, and finally customize the landing page.
Click
Duplicateon a scenario from the scenario library to open it for editing.Click
Continuetwice to pass the Details and Email Editing steps.
1 – Objectives
Customize the credential-harvesting page used in a scenario
Adjust general information (name, URL, language, redirect…)
Edit the content and insert dynamic tokens
Preview or edit the HTML code for full control
2 – Prerequisites
Admin permissions to modify a scenario
A duplicated scenario from the scenario library
3 – Select a landing page
3.1 – Choose a starting landing page
In the list of available landing pages, click Select Landing on the desired card
Once selected, the step is automatically marked as completed.
4 – Edit the landing page general settings
4.1 – Open the editor
Click
Duplicateon the landing page card
A panel opens from the right: this is the landing page editor.
4.2 – Editable fields
You can edit:
Landing page name
Page title
Page URL
Redirect URL
Language
Threat type
Domain used in the URL
5 – Edit the landing page content
5.1 – Use the visual editor
From the toolbar, you can:
5.2 – Use dynamic tokens
The following tokens automatically insert information related to the target or the organization:
Token | Example | Description |
| John | Employee’s first name |
| Doe | Employee’s last name |
| Employee’s email | |
| Arsen | Organization name |
|
| Logo |
|
| Resized logo |
| URL | Logo URL |
| 04/10/2022 | Short date |
| 04 Oct. 2022 | Medium date |
| Friday, October 14, 2022 | Long date |
| 14:56 | Time |
5.3 – Edit the HTML code
Click
<>to open the full HTML sourceFor advanced editing, copy/paste the code into an external editor
5.4 - Best practices for a custom landing page
Note: basic HTML knowledge is required to create a landing page from scratch. To reduce errors, we recommend starting from an existing template, duplicating it, and then only adapting the necessary text, fields, and styling.
For a custom landing page to work properly in a scenario, the fields you want to submit must be included inside an HTML form (<form>), with a submit button of type submit placed inside the form. For example, our provided templates use a structure containing a form, input fields, and then a <button type="submit"> button to trigger the page submission.
When the user submits the form, password fields (<input type="password">) can be present to reproduce a realistic experience, but Arsen does not collect them under any circumstances.
Here is an example of a minimal functional page for your tests:
<!DOCTYPE html>
<html lang="{{ lang }}">
<head>
<meta charset="utf-8" />
<title>Login</title>
</head>
<body>
<main>
<h1>Log in to your account</h1>
<form method="post" action="#">
<label for="email">Email address</label>
<input
id="email"
name="email"
type="email"
required
placeholder="[email protected]"
/>
<label for="password">Password</label>
<input
id="password"
name="password"
type="password"
required
placeholder="Password"
/>
<button type="submit">Log in</button>
</form>
</main>
</body>
</html>
Click the 👁️ icon to preview the landing page before validating it.
Example of a Google login page:
6 – Configure a Click-Only scenario
6.1 – Enable Click-Only mode
Click the Click Only panel to activate this mode
6.2 – Set the redirect URL
Choose the URL employees will be redirected to after clicking the link
In this mode:
The credential-harvesting page is disabled
Only the click is measured










