Spear-phishing

Spear-phishing is phishing aimed at a specific person or a small group, built around details that make the message look routine to that reader. Instead of sending the same lure to millions, the attacker researches names, roles, suppliers and current projects, then writes something the target expects to receive. The goal is usually credentials, a payment or access to internal systems.

How it works

Attackers collect information from company websites, professional networking profiles, press releases, job ads and earlier data leaks. They then send a message from a lookalike domain, a free email account using a colleague's name, or a genuinely compromised mailbox. The content refers to real people and real work: an invoice from a known supplier, a shared document from a manager, a note from IT about a new system. Because the context is right, the usual warning signs are weaker. When the target is a senior executive, the attack is often called whaling; when the goal is a fraudulent transfer, it overlaps with business email compromise.

Example

An illustrative case: a finance employee at a fictional manufacturer receives an email that appears to come from the company's logistics partner and quotes the correct contract number. It links to a "shared invoice" on examplecorp-docs[.]com, which asks for the employee's company email password. The attacker then uses the captured mailbox to send further, even more convincing, messages to colleagues and partners.

How to spot it

• The request is unusual for the sender, even though the tone and details feel right.
• The sending domain differs slightly from the partner's real domain, or replies go to another address.
• A document link leads to a sign-in page instead of the file.
• There is pressure to act before a deadline or to keep the request confidential.
• Bank details, contact people or processes are said to have changed.

What brands can do

Spear-phishing depends on credibility, so the defence is to make impersonation harder and verification routine:

• Enforce DMARC on all your domains, including those that never send mail.
• Watch for new registrations that resemble your brand and the domains of your key partners.
• Agree a call-back rule for payment and access changes, using a phone number you already know.
• Train staff with realistic examples and make reporting a suspicious message quick and blame-free.

When a campaign relies on a fake login page or a lookalike domain, Phishvoid can verify the site and file the takedown with the registrar and hosting provider; contact the team if you need help. More background is in What is spear-phishing.

Read more: What Is Spear Phishing? Examples, Red Flags and Defenses