What Is Spear Phishing?

Phishing is the most common form of cyberattack in the world. Over 323,000 Americans fell victim to a successful phishing attack in 2020.

Spear phishing, on the other hand, is a more targeted form of a phishing attack and is far more sinister. Targeted phishing can put your organization at risk. In this guide, we explore what spear phishing attacks are and how to defend against them.

A spear phishing attack is executed by sending emails to well-researched targets to secure money or information, or to successfully install malware on the target’s computer.

These highly effective scams are carried out by sophisticated attackers and can be incredibly difficult to stop.

Phishing campaigns seek out low-level targets in large numbers. They can be easily created by someone with little to no technical experience and are generic in nature.

On the other hand, spear phishing is purpose-built to attack a specific individual or entity. They are highly detailed and require large amounts of research to successfully impersonate a known individual and win the target’s trust.

In short, the difference is that spear phishing is designed for a specific target, whereas conventional phishing campaigns look to cast a wide net.

To make matters worse, attacks exist on an even higher level called whale phishing. These targeted phishing campaigns typically target high-level executives through impersonation. Because these executives have access to financial information, sensitive data, and other high-level items, they are considered a big fish—or a whale.

Using a high-level executive’s superior rank, attackers use whale phishing to coerce lower-level employees into sharing sensitive information or sending funds to the attacker’s account.

A spear-phishing attack has many of the same goals as a conventional phishing campaign as attackers look to extract information or money from the target. That said, global security experts are increasingly finding that attackers are looking to compromise API and session tokens.

Primarily, most spear phishing examples arise through in-depth reconnaissance of the chosen target. At its core, spear phishing (sometimes misspelled spear phishing) is little more than a targeted phishing attack in that it still occurs through email spoofing.

Spoofing is possible because of the Simple Mail Transfer Protocol (SMTP), which is unable to authenticate email addresses in its base form. This fundamental flaw enables attackers to impersonate high-value targets to achieve their goals.

Within a spear-phishing email, the target is always well-chosen, with the attacker focusing specifically on that one person or organization. There is also a huge reconnaissance element to a successful attack. Attackers will typically harvest information through dark web data breaches, social media platforms, and company websites, among others.

Once the attacker believes they have enough information on the target, they will launch their attack via conventional email spoofing, though texting and voice calls have also been used. Like a conventional phishing campaign, the email may use easily overlooked variations of a genuine address.

For example, an attacker may switch out an “o” for a “0” or incorporate Cyrillic lettering into their spoof emails.

Attackers use a combination of digital platforms and social engineering to achieve a successful attack. However, the scary fact is that spear phishing requires nothing more than a basic email account.

The dark web increasingly sells out-of-the-box phishing kits to automate much of the process. Criminal services may even offer to carry out research through social media scraping on the attacker’s behalf.

Once the attacker has taken the time to research the chosen target, only two basic tools are required to execute the attack:

• SMTP Server: These can be purchased at an extremely low cost through well-known web hosting companies. SMTP servers may be installed on an attacker’s system by utilizing port 25.
• Mailing Software: Mailing software is used to send phishing emails. While the open-source PHP Mailer is highly favored, well-known software options like Microsoft Outlook can also be used.

The lack of necessary tools needed to carry out a targeted phishing campaign is why 91% of cyberattacks begin with a simple email message. Business leaders must familiarize themselves with how to recognize and protect themselves against these damaging spear-phishing attacks.

Traditional shotgun phishing campaigns are relatively easy to spot because of the lack of personalization. A spear phishing email, on the other hand, will always look different.

However, several commonalities give attackers away, including:

1. The display name may be different from the email address
2. The email typically appears to come from a known person
3. There may be links or attachments in the email, known as the payload
4. The body copy creates a sense of urgency and will seek to get a reaction from the reader

Some of the spear phishing examples every organization should be aware of include:

• Gift Card Scams: Especially prevalent around the holidays, the requests ask employees to buy gift cards for an employee or customer appreciation event. After purchase, the attacker asks the victims to send the gift card numbers to them.
• Bank Account Breach: An email appears to come from a bank and claims the company’s bank account has been breached. Sophisticated spoofs may include a phone number, where the recipient may unwittingly give away an organization’s financial details.
• Invoice Payment: While impersonating the CEO or other decision maker, the scammer sends a request to an employee asking that they pay an overdue invoice to a new or existing vendor. Naturally, the money ends up in an untraceable foreign bank account.

A 2015 Intel study revealed that 97% of employees could not identify phishing emails of any kind. It’s thus no surprise that these scams cost organizations billions each year.

From Marriott losing 5.2 million records to phishing and Ubiquiti Networks, Inc. unwittingly handing over $40 million to attackers, the costs of a successful spear phishing attack are enormous.

The consequences of these campaigns include:

• Loss of revenue
• Loss of consumer confidence and reputational damage
• Severe business disruption
• Lawsuits and other legal issues
• Dark web leaks

And this is list is not exhaustive—the impacts of falling victim to spear-phishing attacks are wide-ranging and could take years to recover from. One Verizon study revealed that public companies that experience these attacks suffer an average 5% decline in their stock price six months after the fact.

Regardless of the organization’s size, employees at every level must be aware of phishing and how to prevent it. Attackers may target many levels of an organization rather than simply the big decision-makers.

Spotting spear-phishing attempts is becoming increasingly complex, but if you know what to look for, they can be relatively simple to find. If you’re ever in doubt, helpful questions to ask yourself include:

• Is the email address correct? Does it have strange symbols, or does it seem different from the sender’s actual address?
• Is the sender trying to encourage the receiver to do something at extremely short notice? Is there a sense of urgency in the email?
• Are there any unusual links or attachments within the email?
• Does the tone of the message differ from the sender’s usual tone?
• Does the request differ from a typical request that the sender would make?

Most vigilant employees can spot spoofing attempts from a mile away. However, all it takes is a simple lapse in judgment or concentration to unwittingly give up sensitive information to a cybercriminal.

Everyone can fall victim to spear phishing attacks, but there are some actions you can take to minimize the risk.

• Double-check everything. Make sure that the email address is accurate, and check the request to ensure it’s legitimate.
• Verify with the sender. Call the sender or another member of the department to verify any requests made.
• Retype the link. Never click a link inside an email. Type the domain instead and access your accounts independently.
• Copy and paste the email text. Enter the body of the email into Google. Many spear phishing email examples utilize off-the-shelf spoofing kits.
• Scan attachments. Make sure your email provider automatically scans attachments for potential malware or ransomware. The best email security software will also find and block spear phishing attacks via a behavioral data science-based approach.
• Spread awareness. Ensure employees are aware of spoofing and train them to spot and react to suspicious communications.

Spear phishing may be relatively simple to carry out, but these attacks cost businesses billions worldwide every year, not to mention the general disruption and distrust they cause.

Organizations worldwide are protecting their employees against phishing attacks with Abnormal Security. Investing in our state-of-the-art email security platform can bolster your defenses and decrease your chances of becoming a statistic.

Learn more about how Abnormal Security protects against spear phishing by requesting a demo today.