Spear phishing
Phishing aimed at a specific person or organization, using details about them to make the message convincing; aimed at executives it is called whaling.
What it means
Where mass phishing relies on volume, spear phishing relies on research. Attackers use what an organization publishes, on its website and social media, to write messages that refer to real colleagues, suppliers and projects. The NCSC notes these are harder to detect than generic phishing and calls those aimed at senior people whaling.
The technical tricks are the same as in other phishing: spoofed or lookalike domains, display names of colleagues, or a genuinely compromised account. Business email compromise can start this way.
Defences combine DMARC enforcement on your own domains, impersonation protection on the receiving side, and procedures that verify payment or data requests by another channel.
Related terms
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- UK NCSC: Phishing attacks, defending your organisationncsc.gov.uk
- Microsoft Learn: Anti-phishing policies in Microsoft 365learn.microsoft.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes