Skip to main content

Phishing report button for Mozilla Thunderbird

  • Updated

This article describes how to install and configure the SMARTFENSE phishing report button for Mozilla Thunderbird, including centralized installation for the entire organization and individual installation, as well as notification and text configuration.

Prerequisite: regardless of the email client used, you must validate your corporate domains in SMARTFENSE for the button to work correctly. This step is mandatory and must be completed alongside the installation.

See the guide: How to validate a domain in SMARTFENSE

Version requirement: Mozilla Thunderbird version 128 or higher (ESR).

To access the configuration, go to Settings > Simulations > Phishing report button. The section is organized into three tabs: Installation, Notifications, and Texts.

Installation tab

This tab allows you to obtain the button installer and access the installation guide for Thunderbird.

  1. Under Email client, select Thunderbird.
  2. Click Installation guide to view the detailed steps for each installation method, or click Download installer to get the .xpi file for your instance.
  3. Complete the installation following the appropriate option (see below).
  4. Click Save.

Option A: organization-wide installation (recommended)

This option allows an IT administrator to install the extension on all computers in the organization in a centralized way, using Thunderbird policies.

Step 1

On each computer where Thunderbird is installed, create the policies.json file in the Thunderbird distribution directory:

  • Windows: C:\Program Files\Mozilla Thunderbird\distribution\policies.json
  • macOS: Thunderbird.app/Contents/Resources/distribution/policies.json
  • Linux: /usr/lib/thunderbird/distribution/policies.json

If the distribution directory does not exist, create it manually.

Step 2

Copy the following content into the policies.json file:

 
json
{
  "policies": {
    "ExtensionSettings": {
      "phishing-report-button@smartfense.com": {
        "installation_mode": "force_installed",
        "install_url": "https://[instance].takesecurity.com/api/phishing-report-button/thunderbird/457effc4a417d83658434f8490ac483af7dc25f2/download/"
      }
    }
  }
}

Step 3

Restart Thunderbird. The extension will install automatically and users will not be able to uninstall it.

Note: On Windows, this file can be distributed centrally using GPO (Group Policy), SCCM, Intune, and other management tools. On macOS environments managed with MDM (Jamf, Intune, Kandji), as an alternative to policies.json, the policy can be applied from the org.mozilla.thunderbird.plist file published by Mozilla, converted to a configuration profile (.mobileconfig) using tools such as mcxToProfile or Profile Creator.

Option B: individual installation

This option allows you to install the extension manually on a single computer.

  1. Download the .xpi installer file using the Download installer button in the Installation tab.
  2. In Thunderbird, go to Tools > Add-ons and Themes (or press Ctrl+Shift+A).
  3. Click the gear icon and select "Install Add-on From File..."
  4. Select the downloaded .xpi file and confirm the installation when Thunderbird prompts for permissions.
  5. The "Report Phishing" button will appear in the toolbar when viewing an email.

Notifications tab

This tab allows you to manage the email notifications generated after each report received by SMARTFENSE.

  • New report alert: enable or disable notifications each time a user reports an email using the button.
  • Recipients: enter the email addresses that will receive reports of external emails (not originating from simulations). If more than one address is entered, they must be comma-separated, with no spaces.

Click Save to apply changes.

Texts tab

This tab allows you to configure the messages shown to users when they use the report button in their email client.

  • Use SMARTFENSE default texts: the button displays the standard messages defined by the platform.
  • Use custom texts: allows you to edit the messages for each available language. Languages are selected using the flag icons in the Button texts section.

Click Save to apply changes.

💡 Best Practices

  • Use Option A for corporate deployments: it ensures the button is present on all computers and cannot be removed by users.
  • Verify that the version of Thunderbird installed on the computers is 128 or higher (ESR) before starting the installation.
  • In Windows environments with GPO, distribute the policies.json file as part of your software policy to simplify deployment.
  • In the Notifications tab, centralize reports to institutional email addresses belonging to the security team.
  • If you want to customize the messages shown to users when reporting, use the Texts tab to tailor the language to your organization's needs.
  • Run a test report to confirm the button is working before announcing it to users.