Outlook add-in for Windows: administrator guide

The PhishTrainer Report add-in for Outlook for Windows adds a “PhishTrainer by Bexxo” group to Outlook. Your employees use it to send a suspicious email (phishing or spam) to your organization's security team, via PhishTrainer.

It is a VSTO add-in, installed on each workstation by an MSI installer. The publisher shown is “Bexxo by tesweb SA”. PhishTrainer is Bexxo software. Bexxo is the cybersecurity division of Tesweb SA. This guide describes version 2.2.2 of the add-in.

• Outlook 2016, Outlook 2019 and Outlook 2021;
• Microsoft 365 Outlook, classic desktop app;
• on 64-bit Windows. Outlook can be 32-bit or 64-bit: the add-in is registered for both.

PhishTrainer offers two Outlook add-ins, to be chosen according to your employees' Outlook client:

The two can be combined: each one is a separate reporting source in PhishTrainer.

• 64-bit Windows;
• .NET Framework 4.7.2 or later;
• Visual Studio 2010 Tools for Office Runtime;
• administrator rights on the workstation for the installation: the MSI installs the add-in for all users of the machine, in C:\Program Files\PhishTrainer\Report;
• outbound https access to app.phishtrainer.com. The add-in goes through the Windows system proxy, with the user's Windows credentials.

• the complete reported email (.msg format, including attachments, unless the employee chooses to send it without them);
• the type chosen (phishing or spam) and the boxes ticked by the employee (link clicked, attachment opened, password or information entered, reply or call);
• the add-in language;
• the address of the mailbox that contains the email.

If the employee states that they entered a password or opened an attachment, and the email is not a PhishTrainer simulation, an alert is sent by email to the PhishTrainer administrators. The alert never blocks the report.

• the workstation name, the Windows user and the add-in version;
• the addresses of the connected mailboxes (see below): the server only keeps hashes of them.

The workstation is then identified by a device token, encrypted locally for the Windows user. The employee has no PhishTrainer account or password.

The add-in keeps a local log, with no token, no email address and no message content, in %LOCALAPPDATA%\PhishTrainer\Report\logs (one file per day, kept for 7 days).

The activation code can be provided in three ways. The first two activate the workstations with no action from employees.

Installation does not ask for any code: you can install the add-in and activate it later. As long as it is not activated, clicking a reporting button opens the “Discover PhishTrainer” window, which offers to set it up.

If employees install and activate the add-in themselves, the Message to employees tab of the source provides ready-to-send text, with the download link and the activation code. They then need administrator rights on their workstation.

Command to run with administrator rights (for example through Intune, SCCM or a startup script):

• The Installation tab of the source shows this command with the file name and your code already filled in.
• The code is not written to the msiexec installation log.
• During an update or a repair run without a code, the code already installed is kept.

Install the MSI without a code, then create this registry value on the workstations, for example with a Group Policy preference:

• The activation code, the MSI ENROLLMENTTOKEN parameter and the EnrollmentToken value are the same value. If a workstation receives both, the policy value takes precedence over the MSI value.
• With a code set by policy, the Settings window no longer shows the code entry, but: “The connection is managed by your IT department: no action is needed on your part.”
• If you change the policy value (for example after regenerating the code), the workstation reactivates with the new code the next time Outlook starts or at the next synchronization.

On activation, the workstation connects up to 5 addresses of mailboxes in the Outlook profile to PhishTrainer. An employee can only report emails from a connected mailbox.

• Mailbox added to the profile after activation: Outlook shows “New mailbox in Outlook”. With a code set by GPO or by the MSI, the Connect now button connects the mailbox with no input (and the add-in tries to connect it on its own when Outlook starts). Otherwise, the employee reopens the Settings and pastes the activation code again.
• Shared mailbox opened without an account in the profile: its emails are reported in the name of the workstation user.
• Beyond five accounts in the profile, the sixth cannot be connected.

The add-in does not update itself. It checks at most once a day whether a newer version exists: an orange badge then appears on the About button, whose window offers Download. Installation requires administrator rights on the workstation.

In a company, redeploy the new MSI (same command or same method as for installation). A new version replaces the old one; a version older than the one installed is refused. The Installation tab of the source shows the latest published version.

The add-in is installed as the “PhishTrainer Report” program (publisher “Bexxo by tesweb SA”): uninstall it like any Windows program. Also remember to revoke the workstation in the Enrolled devices tab.

Without a connection to the server, the report is not queued: it fails and the employee must do it again.

In the About window, the Copy diagnostic information button copies to the clipboard the version of the add-in, of Outlook and of Windows, the connection status, the organization, the date of the last synchronization, the workstation ID and the location of the logs. This information contains neither token nor activation code. If needed, attach the workstation logs, located in the folder given in the “Data processed” section.