What is spear phishing?

Ordinary phishing is a mass mailing: the same fake bank email goes to millions of inboxes and the sender hopes a few people click. Spear phishing flips that. The attacker picks a target first, learns something about them, and writes a message that fits.

CISA's phishing guidance describes it as phishing targeted at an individual by including key information about them. Its attack-technique reference adds that the target can also be a particular company or industry, in contrast to non-targeted mass phishing. In practice the message arrives as an email, text or direct message with a link or attachment, and it pretends to come from someone you would trust: a colleague, your boss, a supplier or a company you really use.

What it looks like

Say you work in finance and get an email that uses your manager's name, mentions a real project and asks you to open an "updated invoice". Nothing in it looks off, because the details are right. That is the whole trick. The links and attachments are what do the damage, for example by installing malware or sending you to a fake login page that captures your password. CISA described one recent campaign that sent malicious remote desktop files to government and IT organizations to get at files on their networks.

Where attackers get the details

They only need information you or others have already made public: a job title on a professional profile, a company directory, a social media post, or a people-search listing that ties your name to your address, phone number and relatives. The more of this sits in one place, the less work it takes to write a believable message. That is why it matters to ordinary people and not just to company staff.

Spear phishing vs. related terms

• Phishing is the general attack, sent to many people with generic wording.
• Smishing and vishing are the same idea over text message and phone call.
• Social engineering is the wider category: any trick that gets a person to hand over access or information.