Spear Phishing is a highly targeted form of phishing in which the attacker tailors a deceptive communication to a particular individual, organisation, department or small group. Instead of relying primarily on volume, spear phishing uses information about the intended recipient to make the communication appear relevant and credible. The attacker may know the person's name, job role, employer, current project, suppliers, colleagues, professional interests or recent activities.
This information can come from publicly available material, previously compromised accounts, data breaches, social platforms, business documents or information obtained through earlier interactions. The objective can include credential theft, financial fraud, malware delivery, intelligence collection or initial access to a larger network. Spear phishing is therefore distinguished from generic phishing primarily by targeting and personalisation. A message does not need to contain extremely sophisticated malware to qualify; the distinguishing feature is the deliberate tailoring of the deception. Because the attacker may know enough about the recipient to anticipate normal behaviour, spear phishing can be difficult to detect through superficial inspection.
Reconnaissance is often a significant part of spear-phishing preparation. Attackers may collect organisational information, identify reporting relationships, determine which services employees use and establish which individuals have authority over particular processes. Public websites, professional biographies, organisational charts, published documents and social posts can reveal useful contextual information. Previous compromises can provide even more valuable information, including correspondence and internal terminology. Attackers may then construct a narrative that fits the target's expected work.
For example, a person involved in procurement may receive a message appearing to concern a supplier invoice, while a member of an administrative team might receive a document relating to a meeting or internal process. The credibility comes from contextual consistency rather than merely copying a company logo. Attackers can also use information gathered about colleagues so that a fraudulent request appears to originate from a familiar person. This demonstrates why information exposure can have security consequences even when the exposed information is not itself confidential: seemingly ordinary details can become useful components of a larger deception.
Spear phishing frequently relies on impersonation and authority. An attacker may impersonate an executive, colleague, supplier, customer, legal representative or technical administrator. The communication may use a legitimate-looking display name while the underlying address or communication account is different, or it may originate from a genuinely compromised account. Compromised accounts are particularly dangerous because they provide authentic conversation history, familiar addresses and realistic organisational context.
Attackers may enter an existing email thread or send a message at a strategically chosen time, making the fraudulent request harder to distinguish from legitimate business activity. Some attacks deliberately avoid requesting passwords and instead ask the victim to perform an operational action, such as changing payment details, sending confidential information or approving a transaction. This broadens the security problem beyond traditional credential phishing. Organisations therefore need procedures that independently verify high-impact actions, especially when a request deviates from established processes or introduces urgency, secrecy or unusual payment instructions.
Spear phishing can be used as an initial access mechanism for larger intrusions. A targeted recipient may be selected because their account provides access to sensitive systems, privileged information or useful relationships. If credentials are obtained, attackers may attempt to access email, cloud applications or internal services and then use the compromised identity to identify additional targets. A malicious attachment or document may instead attempt to establish a foothold directly on the endpoint.
Once inside an organisation, the attacker can use information from internal communications to make later deception even more convincing. This creates a relationship between targeted phishing and broader intrusion operations: the phishing message is sometimes only the first stage of a multi-stage campaign. Defenders should therefore investigate successful spear-phishing incidents beyond the immediate message. The relevant questions include whether credentials were exposed, whether authentication occurred afterwards, whether malicious files executed, whether mailbox rules or forwarding settings changed, whether unusual applications were authorised and whether other accounts received messages generated from the compromised identity.
Strong authentication reduces some of the risks associated with spear phishing, particularly when the attacker obtains only a password. However, authentication technology cannot replace process controls because the attacker may instead manipulate an already authenticated user into approving an action. Authentication prompts can themselves become targets if users are persuaded to approve unexpected requests. More resistant authentication mechanisms can reduce certain credential-theft techniques, while security monitoring can identify unusual login locations, devices, sessions and application activity.
Email security can also analyse links, attachments, sender infrastructure and behavioural patterns. Nevertheless, targeted attacks can use legitimate infrastructure and compromised accounts, making purely reputation-based filtering less reliable. Organisations should therefore combine technical controls with verification procedures. For high-value actions, a second person or independent communication channel can verify the request. The appropriate degree of verification should correspond to the potential impact of the action rather than simply to whether the request looks unusual.
Preventing spear phishing involves reducing both the attacker's information advantage and the consequences of successful deception. Organisations can minimise unnecessary exposure of sensitive organisational information, review publicly available documents for excessive operational detail and protect internal directories and communication systems appropriately. Employees should understand that personalisation is not evidence of authenticity. Security training should include realistic examples showing that attackers may know genuine details about projects, colleagues or suppliers.
High-risk business processes should contain controls that do not depend on the authenticity of an email alone. Financial changes, credential resets, sensitive data transfers and privileged-access requests can require independent verification or additional approval. Incident reporting should be straightforward because rapid reporting can allow security teams to invalidate compromised credentials, quarantine malicious messages and warn other recipients. The objective is not to expect individuals to defeat sophisticated social manipulation unaided but to construct organisational processes in which a convincing fraudulent message is insufficient to cause a high-impact action.
Spear phishing differs from generic phishing mainly in the degree of targeting, but the boundary is not always absolute. A campaign may begin with broad research and then target selected groups with partially customised messages. A message can therefore contain some personalisation without necessarily representing the most sophisticated form of targeted attack. The important analytical question is whether the attacker deliberately used information about a specific target to improve the deception.
Spear phishing should also not be confused with legitimate personalised business communication, because personalisation itself is not malicious. The security concern arises when personalisation is used deceptively to induce an unauthorised action. This distinction is particularly important in automated security systems because overly simplistic rules such as treating personalised messages as inherently suspicious would generate excessive false positives. Effective analysis instead considers sender authenticity, context, requested action, communication history, destination, authentication state and whether the request is consistent with established organisational procedures.
A successful spear-phishing incident should be treated as potentially broader than the initial message. If a victim entered credentials, those credentials may need immediate remediation and related authentication activity should be reviewed. If a malicious document was opened, the endpoint may require investigation for persistence or additional malware. If the message involved payment instructions, relevant financial processes should be checked for unauthorised changes.
If the attacker accessed an email account, forwarding rules, delegated access, application permissions and sent messages may require review. Organisations should also determine whether the attacker obtained information that could support subsequent targeting. This incident-response perspective is important because spear phishing is often valuable to attackers precisely because it can provide information and access that make later attacks easier. The immediate fraudulent message is therefore only one observable part of the activity.
