Spear Phishing: When the Attack Is Aimed Exactly at You

There's a difference between getting a generic email that says "Dear customer" and getting one that mentions your boss's real name, the exact project you're working on this week, and the vendor your company signed a contract with last month. The first gets dismissed in seconds. The second creates doubt, because it seems impossible for an outsider to have that much correct context. That's exactly the difference between generic phishing and spear phishing — and it's why spear phishing has considerably higher success rates.

Traditional phishing works by volume: thousands of generic emails go out, and it only takes a small percentage landing to make the attack profitable. Spear phishing completely inverts that logic. Instead of volume, the attacker invests time researching one person or a small group of specific people within an organization, gathering information from public sources — LinkedIn, the corporate website, social media posts, press releases — to build a message that feels genuine and contextually correct.

A well-crafted spear phishing email can mention a colleague's correct name, reference a real project the company is handling, or even mimic the usual writing style of whoever it claims to be from. The more research goes in beforehand, the harder it is to distinguish from a legitimate communication.

Not every employee at a company receives the same level of attention from an attacker running spear phishing. Roles with access to financial systems, authority to approve transfers, or access to sensitive company information are disproportionately more researched targets — precisely because compromising just one of those accounts can give the attacker direct access to what they're actually after, without needing to compromise dozens of lower-value accounts.

Finance teams, executive assistants with access to a director's calendar and email, and IT staff with elevated administrative permissions are consistently the most-researched targets in spear phishing campaigns aimed at businesses.

Spear phishing is rarely the end goal itself — it's frequently the reconnaissance or initial-access step within a larger attack. Credentials obtained through spear phishing can be the entry point into a ransomware-as-a-service attack, or the first step toward CEO fraud, where the attacker, now inside an executive's actual email account, can request fraudulent transfers with a credibility an external email could never have.

Limit publicly available information about specific roles and responsibilities. There's no need to hide that someone works in finance, but publishing specific operational details — which systems they use, which vendors they work with directly — gives an attacker unnecessary research material.

Out-of-band verification for any unusual request, especially ones involving money, access changes, or sensitive information — no matter how convincing and well-informed the sender appears.

Multi-factor authentication on all high-value accounts, so credentials stolen through spear phishing aren't enough on their own.

Role-specific training for the highest-exposure positions, not just generic company-wide training. Finance teams and executives need training adapted to the tactics specifically used against them.

The signals we cover in our guide on how to spot a phishing email still apply, but with spear phishing there's an additional pattern worth watching for: requests that, even when the sender appears legitimate and well-informed, break from the established normal process — an executive who "exceptionally" asks for an urgent transfer skipping the usual approval process, for example. That break from normal process is often a more reliable signal than any technical detail of the email itself.