What is spear phishing?

Spear phishing is phishing aimed at one person or a small group, written with details that make it believable: their name, role, current projects, suppliers or colleagues. Attackers collect those details from the company website, LinkedIn, press releases, earlier data breaches or a mailbox they already control. A message to an accounts clerk might mention a real supplier and a real invoice number; one to an IT administrator might look like an alert from a tool the company actually uses. When the target is a senior executive, it is sometimes called whaling. Because these messages are tailored, filters catch fewer of them and staff find them harder to spot. The best defences are process ones: verify unusual requests through a second channel, limit what you publish about internal roles and payment processes, and give the people with access to money or admin rights phishing-resistant MFA first.

← All 29 questions on Phishing and e-mail aftermathAll topics