What Is Spear Phishing?

Spear phishing is phishing aimed at specific individuals, built on research about them. Where mass phishing relies on volume, this relies on plausibility, and it is correspondingly harder to detect and far more likely to succeed.

It is the initial access method of choice for targeted intrusions, because a message referencing a real project, a real colleague and a real deadline does not look like an attack.

The research, and where it comes from

Professional networking profiles give names, roles and reporting relationships. Company websites give structure and project names. Conference programmes, press releases and job advertisements give technology in use and current initiatives.

Prior breaches give real internal terminology. Social media gives travel, absence and personal context. None of this requires any access to your systems, which is why it cannot be prevented technically — only anticipated.

Why the usual signals are absent

Mass campaigns are detectable partly through volume and reputation: many identical messages, known-bad infrastructure, sloppy language. A handful of messages from freshly registered infrastructure, well written and contextually accurate, present none of that.

The advice people are trained on — look for poor spelling, generic greetings, unexpected topics — is largely useless here, which is worth saying explicitly in training rather than leaving people with false confidence.

Who gets targeted

Finance staff who can move money. Executives and their assistants, whose authority can be borrowed. IT administrators, whose credentials are worth the most. Human resources, who hold personal data and open attachments professionally.

Also anyone who has recently been publicly associated with the organisation — a new joiner announced on a professional network is a well-known target, because they do not yet know what normal looks like.

Defences that hold when the message is convincing

The same structural ones that address social engineering generally: phishing-resistant authentication, mandatory out-of-band verification for payments and credential changes, and least privilege so a successful attempt reaches less.

Training that tells people convincing attempts exist, and that the verification procedure applies regardless of how legitimate a request appears, is more useful than training on warning signs these messages do not display.

Reducing what is discoverable

The organisation cannot remove its public footprint and can be deliberate about parts of it. Detailed organisational charts, internal project names, direct contact details for finance staff and technology specifics in job advertisements all lower the cost of research.

Reviewing what the website and job postings reveal is a short exercise that occasionally finds something worth removing.

Through a trusted third party

The most effective version does not impersonate anyone. It arrives from a genuinely compromised partner, supplier or customer mailbox, inside a real thread, referencing a real transaction — which means nothing about the message is forged and every authentication check passes.

This is where targeted social engineering meets supply chain attack, and it is why verification procedures have to apply to known contacts rather than only to unfamiliar ones. Trust in the sender is precisely what the attack borrows.

Where to start

Identify the handful of roles whose compromise would matter most, and give them phishing-resistant authentication and a written verification procedure. Targeted attacks target few people, so the defence can be narrow.

See advanced persistent threats. GuardsArm runs phishing simulation.