Spear phishing is a targeted form of phishing in which attackers craft a personalised message for a specific person or organisation to steal credentials or deliver malware.
How spear phishing works
Mass phishing sends the same message to millions of addresses. Spear phishing starts with research: attackers use open source intelligence – LinkedIn profiles, company websites, press releases, leaked data – to learn names, roles, projects and suppliers. The message then looks like an ordinary work email: an invoice from a known partner, a CV for an open position, a shared document from a colleague or a request from the CEO. When the target is a senior executive, the attack is often called whaling.
The email may contain a malicious attachment, a link to a fake login page or simply a request to transfer money or data, as in business email compromise.
Notable cases
- RSA (2011) – an Excel file titled “2011 Recruitment Plan” exploited a zero-day flaw and led to the theft of SecurID data.
- 2016 US election – a fake Google security alert sent to John Podesta gave attackers access to his mailbox.
Why it matters
Spear phishing is the favourite initial access method of APT groups and is increasingly used by ransomware gangs. Personalised messages are far more convincing than generic spam, and AI tools now make it easy to write them in any language.
How to defend
- Train employees with realistic, role-specific examples.
- Use phishing-resistant MFA so that stolen passwords are not enough.
- Enforce DMARC, sandbox attachments and rewrite links.
- Verify unusual requests through a second channel.
