Here you'll find the updated catalog of phishing simulation templates that Whalemate makes available to you. Each template is an email ready to send: you don't have to write or design anything, just choose which one to use when creating your campaign.
Today the catalog has 417 templates: 203 in Spanish, 138 in Portuguese and 61 in English (plus 15 in Italian, French and German). In addition to these, your company may have its own templates, which are visible only to your account.
To launch a campaign with any of these templates, see «Creating an email phishing simulation».
The three types of attack
Each template simulates a different attack, and that defines what gets measured:
Click-only (318 templates) — the email includes a link. It records who opens the email and who clicks. When clicking, the employee lands on the recommendations page you chose.
Credential harvesting (77 templates) — in addition to the click, the employee lands on a fake login screen. It records who enters their username and password there.
Ransomware (22 templates) — the email simulates sending a file. It records who downloads it and who opens it.
How to read a template's name
The names follow a convention that saves you from opening the preview:
[ES] [PT] [EN] at the beginning — the language of the email.[CH] at the end — Credential Harvesting: it's the credential harvesting version.[RW] at the end — it's the ransomware version.
Many brands are available in all three variants. For example, "Microsoft — A "file" has been shared with you" exists as click-only, as [CH] and as [RW]: it's the same story with different measurement depth.
About 4 out of every 10 templates still don't carry the language prefix in the name: these are the oldest ones in the catalog. To filter by language reliably, use the selector's filter and not the name.
Work tools and cloud
The largest family in the catalog: 228 templates. These work best as a first campaign, because they mimic emails the employee expects to receive.
- Microsoft 365 — suspended account, password renewal, shared file · 🇪🇸 🇧🇷 🇺🇸 · click,
[CH], [RW]
- Microsoft SharePoint — file deletion · 🇪🇸 🇧🇷 🇺🇸 · click,
[CH]
- Microsoft Teams — you've been added to a team, is trying to reach you, security breach, join now · 🇪🇸 🇧🇷 🇺🇸 · click,
[CH]
- Google Workspace — security alert, suspicious login, account recovery · 🇪🇸 🇧🇷 🇺🇸 · click,
[CH]
- Google Drive and Google Forms — a spreadsheet was shared, you were added to a shared drive, form · 🇪🇸 🇧🇷 🇺🇸 · click,
[RW]
- Google Cloud and Google Analytics — payment declined, Analytics report · 🇧🇷 🇺🇸 · click
- OneDrive — document sent · 🇧🇷 · click
- AI tools — ChatGPT (webinar, failed payment, reset password, subscription report), Copilot with GPT-5, Gemini, Claude, DeepSeek, Cursor, data shared with OpenAI · 🇪🇸 🇧🇷 · click,
[CH], [RW]
- Atlassian, Jira, Confluence and Trello — API token expiring, suspended account, password recovery, validate personal information · 🇪🇸 🇧🇷 🇺🇸 · click,
[CH]
- Slack — suspended account, confirm your email · 🇪🇸 🇧🇷 🇺🇸 · click
- AWS — login attempt, restore files, billing exceeded · 🇧🇷 🇺🇸 · click,
[CH]
- SAP, ClickUp, Notion, Figma, GitHub, GitLab, Webflow, PandaDoc, Metabase, HubSpot — unauthorized access, export ready, invitations, two-factor · 🇪🇸 🇧🇷 🇺🇸 · click,
[CH]
- Password managers — 1Password (account recovery), Bitwarden (installation) · 🇧🇷 🇺🇸 · click
- Adobe ID — password changed · 🇪🇸 🇧🇷 🇺🇸 · click,
[CH]
- Apple and iCloud — unrecognized purchase, account data updated, purchase receipt, Apple Arcade · 🇧🇷 🇺🇸 · click,
[CH], [RW]
- Zoom, LinkedIn, Instagram, WhatsApp, Spotify and YouTube — meeting invitation, suspended account, password changed, new login, access code · 🇪🇸 🇧🇷 · click,
[CH]
Telephony and internet
Widely used in Brazil, where email from the carrier is routine.
- Claro — line update, internet bonus, open invoice, receipt · 🇪🇸 🇧🇷 · click,
[CH], [RW]
- TIM — line update, internet bonus, access confirmation, document · 🇧🇷 · click,
[CH], [RW]
- Vivo — SIM change, access confirmation, request receipt · 🇧🇷 · click,
[CH], [RW]
- Tigo — password update, in Bolivia and Colombia · 🇪🇸 · click,
[CH]
- Movistar — Cyber Day, iPhone giveaway · 🇪🇸 · click
- Algar Telecom — invoice · 🇧🇷 · click
Banks, finance and wallets
- Argentina banks — Galicia, Macro, Santander Río, ICBC, Banco Nación, BCRA, Byma · 🇪🇸 · click,
[CH]
- Chile banks — Banco de Chile, BCI, BancoEstado · 🇪🇸 · click,
[CH]
- Peru banks — BCP and BBVA: password update, inconsistency in account statement · 🇪🇸 ·
[CH], [RW]
- Colombia and Brazil banks — Bancolombia (business connection), Nubank, Santander, Itaú, Sam's Club · 🇪🇸 🇧🇷 · click,
[CH]
- Wallets and fintech — Mercado Pago, Modo, Takenos, DolarApp, Astropay · 🇪🇸 🇧🇷 · click
- International banking — JP Morgan, Morgan Stanley, BCB (second factor), Chainalysis · 🇺🇸 · click,
[CH]
- Taxes and agencies — ARCA (digital certificates, currency controls, income tax), ARBA (vehicle tax debt, electronic tax domicile, payment plan), DIAN Colombia, sentence notification · 🇪🇸 · click,
[CH], [RW]
Human resources and internal payments
The ones that get the most clicks, because the sender looks internal.
- Profit-sharing payment — receipt, deposit, settlement, notification · 🇪🇸 · click
- Pay stub (TuLegajo) · 🇪🇸 · click
- Deel — you got paid, security alert, feedback survey · 🇧🇷 🇺🇸 · click,
[CH]
- HIBOB, Humange and Naaloo — documents and files · 🇪🇸 · click,
[CH]
- Corporate benefits — Wellhub, Si Vale, Oh! Gift Card, PedidosYa (corporate benefit), Uber (your company's account) · 🇪🇸 🇧🇷 · click,
[CH]
Travel
- Airlines — Aerolíneas Argentinas, LATAM, Sky, JetSmart, Avianca, Aeroméxico, Gol, Azul · 🇪🇸 🇧🇷 · click,
[CH], [RW]
- Agencies and points programs — Despegar/Decolar (Travel Sale, points, passport), TurismoCity, Al Mundo, Pezzati, Pax · 🇪🇸 🇧🇷 · click,
[CH]
Shopping, promotions and calendar dates
Pieces tied to a specific date. It's best to schedule them close to the actual event, which is when the employee is expecting that email.
- World Cup 2026 — Coca-Cola, Visa, Adidas, Aerolíneas Argentinas, favorite player, Club World Cup · 🇪🇸 🇧🇷 · click,
[CH]
- Hot Sale — Nike, Adidas, Rappi, Frávega, Megatlon, Banco Nación, Modo, TurismoCity · 🇪🇸 · click
- Black Friday — Mercado Libre, Despegar, Frávega, Astropay, Turismo City, Samsung · 🇪🇸 🇧🇷 · click,
[CH]
- Cyber Day — Falabella Viajes, Movistar, Autoplanet, Mercado Libre
