Spear Phishing

Spear phishing is a targeted cyberattack in which a criminal studies a particular person, team or company and then sends a message crafted to look as if it comes from someone the target trusts. The aim is to get the victim to click a malicious link, open an infected file, hand over passwords or approve a payment. Where ordinary phishing casts a wide net with the same email to thousands of people, spear phishing uses personal details to make one message convincing.

It is one of the most common starting points for data breaches, ransomware incidents and payment fraud, and a familiar threat to banks, payment firms, crypto exchanges and their staff. It is closely related to business email compromise, in which attackers pose as executives or suppliers to redirect payments, and to whaling, a variant aimed at senior executives. Defending against it combines technology, staff training and payment controls.

An ordinary scam letter is like a flyer pushed through every door on a street: most people throw it away. Spear phishing is more like a stranger who has watched your house, learned your name, your bank and your manager's habits, and then knocks pretending to be a courier with a parcel you were expecting. Because the story fits your life, you are more likely to believe it.

The attacker might write as your boss asking for an urgent transfer, as a supplier with new bank details, or as a colleague sharing a document. The message feels normal, which is the whole trick. The protection is to slow down and check through a different channel, such as calling a known number, before acting on any unexpected request.

1. Research. Attackers gather information from company websites, social media profiles, press releases, earlier data leaks and public filings to learn names, roles, suppliers and writing styles.
2. Pretext. They choose a believable story, such as an overdue invoice, a shared contract, a security alert or a request from a senior manager.
3. Disguise. They use look-alike domains, hacked real accounts or email spoofing so the message appears to come from a trusted sender. Look-alike domains are a form of typosquatting.
4. Payload. The message carries a link to a fake login page that harvests credentials, an attachment that installs malware, or a request to change payment details.
5. Exploitation. Stolen access is used to steal funds or data, move deeper into the network, or plant ransomware.

Attacks increasingly use text messages, messaging apps, phone calls and video meetings, as well as email. Generative AI tools have made it easier to write fluent messages in any language and to imitate voices.

Finance staff are prime targets because they can move money. A common pattern is an email that appears to come from a regular supplier announcing new bank details, after which genuine invoices are paid into a criminal's account, a form of payment diversion fraud. In crypto, attackers target exchange employees, developers who hold signing keys and wealthy holders. Several large exchange and bridge hacks have been traced to staff who opened a booby-trapped file or fake job offer, giving attackers a foothold that led to stolen private keys. Fake messages from wallet providers asking users to "verify" their seed phrase are a retail version of the same idea.

Typical warning signs include unexpected urgency or secrecy, a request to bypass normal procedures, a slightly misspelled sender address, links whose destination differs from the text shown, and requests for login details or recovery phrases. Organizations rely on several layers of defence:

• Verification by a second channel. Changes to payment details and unusual transfer requests are confirmed by calling a known number, never one given in the message.
• Strong authentication. Multi-factor authentication, ideally with hardware security keys, limits the damage of a stolen password.
• Email security. Filtering, sender authentication standards and warnings on external mail catch many attempts.
• Training and testing. Regular awareness sessions and simulated phishing exercises teach staff to report suspicious messages.
• Payment controls. Dual approval for large transfers and confirmation of payee checks reduce the chance that one deceived person can send money away.

Spear phishing is a form of social engineering, so no single tool removes it. Most security teams treat it as part of wider cybersecurity risk and fraud prevention programmes.

• Cybersecurity and Infrastructure Security Agency
• UK National Cyber Security Centre