Spear Phishing

Layer 8: People High risk

How it works

Where general phishing casts a wide net, spear phishing is aimed at a particular person or small group. Attackers research their target using company websites, LinkedIn, news releases, social media and sometimes information from earlier breaches. They learn names, job titles, reporting lines, vendors and current projects, then write a message that references those details so it feels routine and expected.

Common targets include finance staff, executives, executive assistants, human resources and IT administrators, because their accounts carry more authority or access. The message might appear to come from a known supplier, a board member or a partner firm, and it may contain no obviously malicious content at all. The goal is usually credential theft, malware delivery or setting up a later fraud such as a payment redirection.

Warning signs

• A message that references real details but arrives through an unusual channel
• Requests that bypass normal approval processes
• Slightly altered sender names or domains from known contacts
• Unusual tone, timing or urgency from someone you know
• Attachments or links tied to a project you are actually working on

How to defend against it

• Provide role-specific training for finance, executives and administrators
• Flag external senders and lookalike domains in email
• Limit the organizational detail published publicly
• Require phishing-resistant MFA for high-value accounts
• Verify unusual requests through a known phone number

If it happens to you

1. Stop and report the message to IT without replying
2. Reset credentials and revoke sessions if anything was entered
3. Warn colleagues who may have received similar messages
4. Check for new mailbox rules or forwarding on the targeted account