Measuring human resilience, without bluffing.
Social-engineering attacks target humans, not machines. We design and deploy realistic phishing campaigns — including AiTM, capable of bypassing two-factor authentication.
MFA isn't enough anymore. We prove it.
An AiTM (Adversary-in-The-Middle) attack places a proxy between the victim and the legitimate service. The session cookie is captured after full authentication, completely bypassing two-factor authentication.
Carthage
Carthage is the offensive phishing platform developed in-house by Narok. It allows designing, deploying and measuring custom social-engineering campaigns, including large-scale AiTM attacks.
Campaign examples
Fake invoices
Booby-trapped attachments, accounting scenarios.
Shipping notifications
Spoofed carrier relay, redirection.
Credentials update
MFA renewal, password expiration.
Internal communications
HR, IT or executive impersonation.
Of global breaches involve the human element. Verizon DBIR 2024.
Phishing pages identified worldwide in 2024. NC State University.
Average reduction in phishing susceptibility after post-campaign awareness training. University of Adelaide.
Ensure peace.
Prepare for war.
A partner replies within 48 hours for an initial technical exchange.