Gmail add-on: administrator guide

The PhishTrainer Gmail add-on lets your employees send a suspicious email (phishing or spam) to your organization's security team, via PhishTrainer, without leaving Gmail.

The add-on is shown in Gmail on the web, in the side panel on the right, when an email is open. On mobile, it is shown at the bottom of the message.

The add-on is served by PhishTrainer: its screens are generated by the PhishTrainer server for each action, and its updates require no reinstallation. The add-on texts are shown in the language of the Google account (French, German, English or Italian); for any other language, in English.

PhishTrainer is Bexxo software. Bexxo is the cybersecurity division of Tesweb SA (Ins, Switzerland).

• Google Workspace accounts in your domain: recognized automatically if the domain is linked to PhishTrainer (step 2), otherwise with the fallback activation code.
• Personal Gmail accounts (without a Google Workspace domain): usable only with the fallback activation code.

Nothing is read in the employee's mailbox until they click Send report. At that point, the PhishTrainer server reads in Gmail the open email, and only that email, with the permission the employee granted to the add-on. PhishTrainer receives:

• the complete reported email (raw RFC 822 format, including attachments);
• the type chosen by the employee (Phishing or Spam) and the boxes they ticked (link clicked, attachment opened, password or information entered, reply or call);
• the address of the employee who reports, read from the identity token that Google sends with each action. It is never inferred from the content of the email.

If the employee ticked “password or information entered” or “attachment opened” and the email is not a PhishTrainer simulation, the PhishTrainer administrators of your organization receive an alert.

The employee has no PhishTrainer account or password: they are identified by their Google account. The add-on does not log any token, message content or email address, and the IP address is not recorded.

Maximum size of a report: 10 MB, including attachments. Above that, nothing is sent: the add-on asks the employee to forward the email to the IT department. There is no option to send without the attachments.

Linking the domain (step 2) uses a separate Google sign-in, limited to the identity of the signed-in account (openid, email, profile): it gives no access to emails.

If your organization also uses the PhishTrainer Outlook add-in, note that the Gmail add-on does not work the same way on the following points.

Unlike the Outlook add-in, the Gmail source has no option to delete the email after reporting.

The link allows PhishTrainer to recognize the accounts in your domain automatically: with a linked domain, no code is requested from your employees.

The link appears in the Links and users tab, with the scope “Linked Google domain”. Without a link, PhishTrainer remains usable with the fallback activation code.

Installing for the domain equips employees with no action on their part.

Without installation for the domain, each employee can install the add-on themselves:

The Message to employees tab of the source provides ready-to-send text, with the link to the Marketplace listing and the activation code, in the interface language.

With the account of an employee covered by the installation: open an email in Gmail, then open the PhishTrainer add-on. It shows “What do you want to report?” with the choice Phishing / Spam.

• Without an open email, the add-on shows “Select an email to be able to report it.”
• If the add-on asks for an activation code even though the domain is linked, check that the account does belong to the linked domain (Links and users tab).
• On first use, Google may ask the employee to authorize the add-on.