1. An apparatus comprising: a memory; and a processor communicatively coupled to the memory, the processor configured to: receive a first email comprising a first link and an attachment; detect a click of a button that indicates that a user should be warned about the email being a phishing email; in response to detecting the click of the button: generate a new email; alter a destination of the first link to produce a second link; remove the attachment from the first email to produce a second email; and add a deactivated representation of the second email to the new email, wherein the deactivated representation comprises an image of the second email and the second link; communicate the new email to the user; and set a plurality of users as recipients of the new email, the plurality of users determined based on a plurality of recipients of a previous email generated in response to a previous detection of a click of the button.