Spear phishing is a targeted form of phishing in which an attacker crafts a deceptive communication for a specific person, organisation, role, or small group rather than sending the same generic message indiscriminately to a large audience. The attacker may research the intended victim and use information such as their name, job title, employer, colleagues, projects, suppliers, recent activities, or organisational relationships to make the communication appear credible. The objective can be credential theft, malware delivery, financial fraud, unauthorised access, intelligence gathering, or another form of compromise. Spear phishing is therefore distinguished primarily by targeting and personalisation, not by a particular technology or delivery channel.
A spear-phishing campaign often begins with reconnaissance. Attackers may gather information from public websites, professional profiles, social media, company documents, breached datasets, previous communications, or other sources. They use this information to construct a believable scenario. A finance employee might receive a message apparently from an executive requesting an urgent payment, while an employee involved in a particular project might receive a document supposedly related to that project. The attacker may imitate the vocabulary, signature style, organisational structure, or legitimate workflow of the target. The more relevant contextual information the attacker possesses, the more convincing the deception may become.
Spear phishing can use email, messaging platforms, social networks, collaboration applications, telephone calls, or other communication channels. It can involve links to fraudulent authentication pages, malicious documents, requests for sensitive information, instructions to change payment details, or invitations to interact with an attacker-controlled service. Some attacks combine several stages. A targeted message may first steal credentials, after which the attacker uses those credentials to access internal services and send more convincing messages from a compromised account. This can create a feedback loop in which a legitimate account becomes part of the attack infrastructure because recipients are more likely to trust messages originating from a known colleague.
A major distinction between ordinary phishing and spear phishing is the degree of targeting. A generic phishing campaign might send thousands of messages using a broadly applicable lure such as an account warning. Spear phishing may target one executive, a particular employee, or a specific department with a message constructed around their responsibilities. Whaling is a related term commonly used for highly targeted attacks against senior executives or other high-value individuals. Business email compromise frequently uses targeted social engineering and may involve compromised or impersonated accounts. These categories can overlap because one attack can simultaneously be a spear-phishing campaign, an impersonation attempt, and part of a business email compromise operation.
Spear phishing can be especially effective when it exploits legitimate organisational processes. Attackers may impersonate managers, suppliers, lawyers, recruiters, customers, or internal service teams. Instead of asking a victim to do something obviously suspicious, the attacker may make a request that resembles a normal business task but subtly changes a destination, account number, authentication step, or document. This is why security controls should not rely solely on identifying unusual wording or obvious malicious links. Procedures such as independent verification of payment changes, privileged-action approval, secure document-sharing systems, and out-of-band confirmation can reduce the impact of convincing targeted messages.
Technical defences against spear phishing include secure email gateways, malicious-link detection, attachment sandboxing, endpoint protection, domain authentication, browser security, identity protection, and phishing-resistant authentication. However, technical controls cannot reliably detect every well-crafted targeted message because some communications may contain no obviously malicious attachment or link. Identity controls are particularly important because a stolen account can allow attackers to communicate from a legitimate service and potentially bypass simplistic sender-based filtering. Least privilege and conditional access can also limit what a compromised account can reach, while monitoring can identify unusual login locations, session behaviour, forwarding rules, data access, or other signs of account compromise.
Human procedures are an important defence because spear phishing deliberately exploits trust and organisational context. Employees should be encouraged to verify unusual requests through an independently known communication channel rather than replying to the suspicious message or using contact information supplied within it. Financial transfers, password resets, changes to supplier payment information, and requests for sensitive data can require additional approval. Security awareness training should emphasise that a message can look highly personalised and still be fraudulent. Reporting procedures should also make it easy for employees to flag suspected attacks without fear of blame, allowing security teams to investigate and contain related activity quickly.
Spear phishing is a serious initial-access and fraud technique because personalisation can increase the credibility of a deceptive communication. Its success does not necessarily depend on sophisticated malware or an unknown software vulnerability; attackers may instead exploit information, trust relationships, and normal business processes. Effective protection therefore combines technical filtering, strong identity security, phishing-resistant authentication, least privilege, verification procedures, financial controls, security awareness, monitoring, and incident response. Understanding spear phishing requires recognising that the attack is not merely a more convincing version of generic spam: it is a targeted social-engineering strategy in which information about the intended victim is deliberately used to increase the likelihood of a specific harmful action.
