Spear Phishing
Updated
Spear phishing is phishing tailored to a particular person, team, or organization. Attackers use relevant roles, projects, relationships, or current events to make the request credible. The tailoring can be simple; it does not require an elaborate dossier or a high-profile victim to create risk.
What do I need to know about Spear Phishing?
- Public information and previous correspondence can supply convincing details without proving that the sender is legitimate.
- Targets include staff who can approve payments, reset access, share documents, or introduce the attacker to others.
- A request that fits the recipient’s job can still introduce an unauthorized action or destination.
- Reporting should be supportive. Useful context from the recipient can be more valuable than judging whether the lure looked obvious afterward.
An illustrative example
A recruiter receives a message naming an open position and an applicant-tracking tool the company uses. The message asks the recruiter to install a special resume viewer. The role-specific detail creates plausibility, but the installation request departs from the approved hiring workflow and deserves verification.
Practical checks
- Compare the requested action with the legitimate workflow and verify unusual changes independently.
- Preserve contextual details that explain why the recipient was selected, such as the referenced project or role.
- Search for related targeting of colleagues and assess any credentials, documents, payments, or software involved.
Five FAQs about Spear Phishing
How is spear phishing different from bulk phishing?
Spear phishing uses targeting or context tailored to selected recipients. Bulk phishing typically relies on a broadly plausible lure. Both can be damaging, and campaign boundaries may overlap.
Does it only target executives?
No. Staff with useful access or business responsibilities can be targeted. Executive-focused phishing is commonly called whaling.
Can attackers personalize messages with public information?
Yes. Job listings, staff pages, social posts, and public projects can provide enough context. Personalization is not proof that the sender has a legitimate relationship.
Is a reply in an existing thread safe?
Not necessarily. A compromised account or hijacked conversation can introduce a fraudulent request into real correspondence. Verify sensitive changes even when the history looks familiar.
How should training address spear phishing?
Practice verifying realistic requests in employees’ actual workflows, and make reporting easy. Avoid teaching that poor spelling or unfamiliar senders are required signs of an attack.
Sources and further reading
MITRE ATT&CK: Spearphishing attachments for information · Canadian Anti-Fraud Centre: Spear phishing and payment fraud
