What is Spear Phishing?

August 5, 2021

Phishing is the most common form of cyberattack in the world. Approximately 74% of organizations within the United States will experience a successful phishing attack at some point.

Spear phishing, on the other hand, is a more targeted form of a phishing attack and is far more sinister. Targeted phishing can put your organization at risk. In this guide, we explore what spear phishing attacks are and how to defend against them.

Spear Phishing Explained

A spear phishing attack is executed by sending emails to well-researched targets to secure money or information, or to successfully install malware on the target’s computer.

These highly effective scams are carried out by sophisticated attackers and can be incredibly difficult to stop.

Phishing vs. Spear Phishing

Phishing campaigns seek out low-level targets in large numbers. They can be easily created by someone with little to no technical experience and are generic in nature.

On the other hand, spear phishing is purpose-built to attack a specific individual or entity. They are highly detailed and require large amounts of research to successfully impersonate a known individual and win the target’s trust.

In short, the difference is that spear phishing is designed for a specific target, whereas conventional phishing campaigns look to cast a wide net.

Whale Phishing, or Whaling

To make matters worse, attacks exist on an even higher level called whale phishing. These targeted phishing campaigns typically target high-level executives through impersonation. Because these executives have access to financial information, sensitive data, and other high-level items, they are considered a big fish—or a whale.

Using a high-level executive’s superior rank, attackers use whale phishing to coerce lower-level employees into sharing sensitive information or sending funds to the attacker’s account.

What is the Goal of Spear Phishing?

A spear-phishing attack has many of the same goals as a conventional phishing campaign as attackers look to extract information or money from the target. That said, global security experts are increasingly finding that attackers are looking to compromise API and session tokens.

How Does Spear Phishing Work?

Primarily, most spear phishing examples arise through in-depth reconnaissance of the chosen target. At its core, spear phishing (sometimes misspelled spear phising) is little more than a targeted phishing attack in that it still occurs through email spoofing.

Spoofing is possible because of the Simple Mail Transfer Protocol (SMTP), which is unable to authenticate email addresses in its base form. This fundamental flaw enables attackers to impersonate high-value targets to achieve their goals.

How Spear Phishing Happens

Within a spear-phishing email, the target is always well-chosen, with the attacker focusing specifically on that one person or organization. There is also a huge reconnaissance element to a successful attack. Attackers will typically harvest information through dark web data breaches, social media platforms, and company websites, among others.

Once the attacker believes they have enough information on the target, they will launch their attack via conventional email spoofing, though texting and voice calls have also been used. Like a conventional phishing campaign, the email may use easily overlooked variations of a genuine address.

For example, an attacker may switch out an “o” for a “0” or incorporate Cyrillic lettering into their spoof emails.

Tools Used By Attackers

Attackers use a combination of digital platforms and social engineering to achieve a successful attack. However, the scary fact is that spear phishing requires nothing more than a basic email account.

The dark web increasingly sells out-of-the-box phishing kits to automate much of the process. Criminal services may even offer to carry out research through social media scraping on the attacker’s behalf.

Once the attacker has taken the time to research the chosen target, only two basic tools are required to execute the attack:

  • SMTP Server: These can be purchased at an extremely low cost through well-known web hosting companies. SMTP servers may be installed on an attacker’s system by utilizing port 25.
  • Mailing Software: Mailing software is used to send phishing emails. While the open-source PHP Mailer is highly favored, well-known software options like Microsoft Outlook can also be used.

The lack of necessary tools needed to carry out a targeted phishing campaign is why 91% of cyberattacks begin with a simple email message. Business leaders must familiarize themselves with how to recognize and protect themselves against these damaging spear-phishing attacks.

What Does Spear Phishing Look Like?

Traditional shotgun phishing campaigns are relatively easy to spot because of the lack of personalization. A spear phishing email, on the other hand, will always look different.

However, several commonalities give attackers away, including:

  1. The display name may be different from the email address
  2. The email typically appears to come from a known person
  3. There may be links or attachments in the email, known as the payload
  4. The body copy creates a sense of urgency and will seek to get a reaction from the reader

Some of the spear phishing examples every organization should be aware of include:

  • Gift Card Scams: Especially prevalent around the holidays, the requests ask employees to buy gift cards for an employee or customer appreciation event. After purchase, the attacker asks the victims to send the gift card numbers to them.
  • Bank Account Breach: An email appears to come from a bank and claims the company’s bank account has been breached. Sophisticated spoofs may include a phone number, where the recipient may unwittingly give away an organization’s financial details.
  • Invoice Payment: While impersonating the CEO or other decision maker, the scammer sends a request to an employee asking that they pay an overdue invoice to a new or existing vendor. Naturally, the money ends up in an untraceable foreign bank account.

A 2015 Intel study revealed that 97% of employees could not identify phishing emails of any kind. It’s thus no surprise that these scams cost organizations billions each year.

What Happens If I Fall Victim to a Spear Phishing Attack?

From Marriott losing 5.2 million records to phishing and Ubiquiti Networks, Inc. unwittingly handing over $40 million to attackers, the costs of a successful spear phishing attack are enormous.

The consequences of these campaigns include:

  • Loss of revenue
  • Loss of consumer confidence and reputational damage
  • Severe business disruption
  • Lawsuits and other legal issues
  • Dark web leaks

And this is list is not exhaustive—the impacts of falling victim to spear-phishing attack are wide-ranging and could take years to recover from. One Verizon study revealed that public companies that experience these attacks suffer an average 5% decline in their stock price six months after the fact.

How Do I Defend Against Spear Phishing?

Regardless of the organization’s size, employees at every level must be aware of phishing and how to prevent it. Attackers may target many levels of an organization rather than simply the big decision-makers.

How to Recognize a Spear Phishing Attack

Spotting spear-phishing attempts is becoming increasingly complex, but if you know what to look for, they can be relatively simple to find. If you’re ever in doubt, helpful questions to ask yourself include:

  • Is the email address correct? Does it have strange symbols, or does it seem different from the sender’s actual address?
  • Is the sender trying to encourage the receiver to do something at extremely short notice? Is there a sense of urgency in the email?
  • Are there any unusual links or attachments within the email?
  • Does the tone of the message differ from the sender’s usual tone?
  • Does the request differ from a typical request that the sender would make?

Most vigilant employees can spot spoofing attempts from a mile away. However, all it takes is a simple lapse in judgment or concentration to unwittingly give up sensitive information to a cybercriminal.

Best Practices and Tips to Avoid Becoming a Spear Phishing Victim

Everyone can fall victim to spear phishing attacks, but there are some actions to you can take to minimize the risk.

  • Double-check everything. Make sure that the email address is accurate, and check the request to ensure it’s legitimate.
  • Verify with the sender. Call the sender or another member of the department to verify any requests made.
  • Retype the link. Never click a link inside an email. Type the domain instead and access your accounts independently.
  • Copy and paste the email text. Enter the body of the email into Google. Many spear phishing email examples utilize off-the-shelf spoofing kits.
  • Scan attachments. Make sure your email provider automatically scans attachments for potential malware or ransomware. The best email security software will also find and block spear phishing attacks via a behavorial data science-based approach.
  • Spread awareness. Ensure employees are aware of spoofing and train them to spot and react to suspicious communications.


Spear phishing may be relatively simple to carry out, but these attacks cost businesses billions worldwide every year, not to mention the general disruption and distrust they cause.

Organizations worldwide are protecting their employees against phishing attacks with Abnormal Security. Investing in our state-of-the-art email security platform can bolster your defenses and decrease your chances of becoming a statistic.

Learn more about how Abnormal Security protects against spear phishing by requesting a demo today.

Blog library cover
With school starting this month, cybercriminals are back in action—targeting university students in an attempt to steal valuable personal information. In a recent attack uncovered by Abnormal, a credential phishing attacker used a legitimate email account and created false urgency to steal student credentials through a phishing website.
Read More
Blog podcast yellow cover
In engineering teams, there’s a mythical concept of a “10x engineer”— engineers who have 10x more impact and responsibility than the average engineer. Do these engineers actually exist? Is this a myth, or a possibility that engineers can realistically aim to become?
Read More

Related Posts

Blog hiring cybersecurity leaders
As with every equation, there are always two sides and while it can be easy to blame users when they fall victim to scams and attacks, we also need to examine how we build and staff security teams.
Read More
Cover automated ato
With an increase in threat actor attention toward compromising accounts, Abnormal is focused on protecting our customers from this potentially high-profile threat. We are pleased to announce that our new Automated Account Takeover (ATO) Remediation functionality is available.
Read More
Email spoofing cover
Email spoofing is a common form of phishing attack designed to make the recipient believe that the message originates from a trusted source. A spoofed email is more than just a nuisance—it’s a malicious communication that poses a significant security threat.
Read More
Cover cybersecurity month kickoff
It’s time to turn the page on the calendar, and we are finally in October—the one month of the year when the spooky becomes reality. October is a unique juncture in the year as most companies are making the mad dash to year-end...
Read More
Ices announcement cover
Abnormal ICES offers all-in-one email security, delivering a precise approach to combat the full spectrum of email-borne threats. Powered by behavioral AI technology and deeply integrated with Microsoft 365...
Read More
Account takeover cover
Account takeovers are one of the biggest threats facing organizations of all sizes. They happen when cybercriminals gain legitimate login credentials and then use those credentials to send more attacks, acting like the person...
Read More
Blog podcast green cover
Many companies aspire to be customer-centric, but few find a way to operationalize customer-centricity into their team’s culture. As a 3x SaaS startup founder, most recently at Orum, and a veteran of Facebook and Palantir, Ayush Sood...
Read More
Blog attack atlassian cover
Credential phishing links are most commonly sent by email, and they typically lead to a website that is designed to look like common applications—most notably Microsoft Office 365, Google, Amazon, or other well-known...
Read More
Blog podcast purple cover
Working at hyper-growth startups usually means that unreasonable expectations will be thrust on individuals and teams. Demanding timelines, goals, and expectations can lead to high pressure, stress, accountability, and ultimately, extraordinary growth and achievements.
Read More
Blog yellow skyline
No one wants to receive an email from human resources that they aren’t expecting. After all, that usually means bad news. And when we think there may be bad news, cybersecurity training tends to fall by the wayside. Threat actors know this, and they’re taking advantage of human emotions.
Read More
Blog rising building
There is little doubt that business email compromise and other advanced email threats are causing significant damage–both financial and reputational—to organizations worldwide. Because these never-before-seen attacks contain few indicators of compromise, they evade secure email gateways and other traditional email infrastructure...
Read More
Blog purple person outline
Identity theft is not a joke, impacting more than 14 million people each year in the United States alone. Over the course of their lifetime, nearly one-third of all people will become victims of identity theft—often as a result of a corporate data breach. Once attackers have access to identifying information like your full name, address, date of birth, and/or social security number...
Read More