Whaling

Whaling is a form of spear-phishing that targets the most senior people in an organization: chief executives, finance directors, board members and their assistants. These people can approve payments, see confidential information and override procedures, so one successful message can be very costly. The term is also used for attacks that impersonate executives to deceive their staff.

How it works

Attackers study public material about leaders: interviews, conference talks, annual reports, social media posts and travel plans. They then write in the right tone about topics the executive actually handles, such as a legal matter, an acquisition, a regulator's request or a board document. Delivery is through a lookalike domain, a spoofed display name, or the compromised account of a lawyer or adviser. Some campaigns add a phone call or a voice or video deepfake to confirm the request. The aim may be the executive's mailbox password, which then enables business email compromise, or a direct transfer approved under time pressure.

Example

An illustrative case: the finance director of a fictional company receives an email from "outside counsel" at examplelaw-partners[.]com about a confidential acquisition. The message asks them to review the documents through a secure portal before a board call that afternoon. The portal is a copy of a familiar file-sharing login page and captures the director's email password.

How to spot it

• Confidentiality is stressed, and the usual colleagues are to be left out.
• The request skips normal approval steps because of a deadline.
• The sender's domain resembles that of a known adviser but is not identical.
• Document links lead to a sign-in page rather than the file.
• Follow-up calls or voice messages come from unfamiliar numbers.

What brands can do

• Give executives and their assistants extra protection: phishing-resistant multi-factor authentication, closer mailbox monitoring and short briefings with realistic examples.
• Require out-of-band verification for any payment or data request that involves leadership.
• Enforce DMARC so your executives' addresses cannot be spoofed exactly.
• Monitor lookalike domains of your own brand and of your main advisers, such as law firms and auditors.

Lookalike domains and fake portals used against executives can be removed like any other phishing site. Phishvoid verifies them and files the takedown; contact the team for more. Related reading: What is spear-phishing.

Read more: What Is Spear Phishing? Examples, Red Flags and Defenses