Create and Manage Target Lists (incl. CSV Import)

Target lists are reusable groups of recipients for your simulations. You create a list once, keep it up to date, and select it in every campaign – for e-mail, SMS and QR code simulations alike.

Where to find it

Click Phishing in the top navigation, then Lists in the sidebar. The page shows all lists of the company you have selected in the header, with the number of targets and the campaigns that use each list.

Step 1 – Create a list

1. Under Create a new list, enter a List name (for example "All Staff" or "Finance").
2. Optionally add a Context, e.g. "Accounting team, works with invoices and payment runs". AutoPhish uses this context to tailor generated messages to the group.
3. Click Create, then Open to go to the list.

You can add or change the context later in the List Context card on the list page (Edit → Save Context).

Step 2 – Add targets

On the list page you have two options.

Add a single target: Fill in First name, Last name, Email and optionally Phone number, then click Add target.

Import a CSV file: Under Bulk actions, click Choose CSV or drag here and select your file. Click Download example CSV to get a template.

CSV format

The file needs a header row. Only email is required, the other columns are optional:

email,firstname,lastname,phone
jane@example.com,Jane,Doe,+436641234567
john@example.com,John,Doe,

• Maximum 1 MB and 2,000 rows per file.
• Duplicate addresses in the file are merged into one target.
• Rows with an invalid e-mail address are skipped and listed with their row number, so you can fix them and import again.
• Invalid or unsupported phone numbers are dropped, but the person is still imported (without a phone number).

Phone numbers (for SMS simulations)

Phone numbers are only needed for SMS campaigns. Use the international E.164 format without spaces, e.g. +436641234567. Supported are numbers from the EU, UK, US, Argentina, Brazil, Chile, Colombia and Uruguay.

Names make messages more convincing

First and last names are used to personalise greetings ("Hi Jane" or "Dear Jane Doe", depending on the tone you choose). If a name is missing, the message falls back to a neutral greeting.

Requirements and good to know

• Verified domain: You can only add e-mail addresses from domains that are verified for your company. If you see "Cannot add targets with an unverified domain", verify the domain first (see "Getting Started: How to set up AutoPhish for your Company").
• One person, many lists: If the same address is in several lists of a company, AutoPhish treats it as one person. Changing the name, e-mail or phone number updates it in all lists, and reports count the person only once.
• Edit or remove a target: Click Edit next to a target to change their details or list memberships. To remove several people at once, paste their addresses into Remove targets under Bulk actions.
• Export: Export targets as CSV downloads the list in the same format as the import.

Use a list in a campaign

In the campaign wizard, in the first step Choose Tone & Style, select the list under Target Email Addresses. The link Manage target lists takes you back to the Lists page if you need to make changes.

Lists synced from Microsoft 365 or Active Directory

Lists created by Directory Sync carry a Microsoft 365 Sync or Active Directory Sync badge. Their members are managed in the source group, so adding, editing or removing people, CSV import and deleting the list are disabled. You can still edit the list context and export it. See "Set up Microsoft 365 Directory Sync (Beta)" and "Set up on-premises Active Directory sync".

Delete a list

Click Delete list on the list page and confirm. By default only the list is removed – the people in it and their history are kept. If you also tick Delete all list members including all records, people who are only in this list are permanently deleted together with their results. In that case you must type the list name to confirm. This cannot be undone.

Troubleshooting

• Import rejected: Check that the file has a header row with an email column, is a CSV (comma separated) and stays under 1 MB / 2,000 rows.
• SMS campaign skips people: They have no valid phone number on the list. Add the number in E.164 format.
• Cannot edit a list: It is probably synced from Microsoft 365 or Active Directory – change the membership in the source group instead.

Updated on: 28/10/2026