Spear phishing

What it is

Unlike mass phishing blasts, spear phishing is aimed at a person, role, or company. The email might reference a real project, invoice, or colleague. That research — from LinkedIn, a prior breach, or your website — is what makes it dangerous.

Whaling is spear phishing aimed at executives; business email compromise often uses spear-phishing entry points.

How it works

1. Select — Attackers pick a target with access to money, data, or credentials.
2. Research — Public posts, org charts, and leaked data customize the bait.
3. Craft — A message from a known vendor, attorney, or boss arrives.
4. Exploit — Malicious link, attachment, or payment instruction.
5. Follow through — Account takeover, wire fraud, or ransomware staging.
6. AI writing tools help scale personalization without obvious grammar tells.

Red flags

• Emails that mention real internal details but arrive at odd hours or from lookalike domains
• Urgent payment or W-2 requests that skip normal process
• Attachments you were not expecting even from a known name
• Slight anomalies in signature blocks, reply-to addresses, or tone
• Requests for MFA codes or password resets initiated by someone else
• Pressure not to verify by phone

What to do if you’re targeted

• **Verify out-of-band** before paying or opening attachments.
• **Hover/check domains** and reply-to fields carefully.
• **If you interacted:** change passwords, enable MFA, alert security/finance, and watch wires.
• **Report** to your IT/security team and, for consumer fraud, ReportFraud.ftc.gov (U.S.).
• **Reduce public oversharing** of org charts and travel plans when practical.
• **Optional:** identity monitoring if personal PII was part of the lure.

Related terms

• Phishing
• Business email compromise
• Social engineering