Spear phishing is a targeted phishing attack: the message is written for a specific person or small group, using real details about them to look credible. Ordinary phishing goes out in bulk. Spear phishing trades volume for believability, so process checks work better than spotting bad grammar.
How is it different from regular phishing?
CISA describes phishing as a form of social engineering that uses email or malicious websites to solicit information by posing as a trustworthy organization. The classic example is a bulk message that appears to come from a bank. Spear phishing narrows the aim. The attacker picks a target, researches them, and writes something relevant: a named colleague, a real project, a plausible invoice.
MITRE ATT&CK catalogs spearphishing as sub techniques of Phishing, technique T1566: attachment, link, via service and voice. In each, the adversary sends a targeted message to gain access to victim systems.
Where does the attacker get details?
From public sources. Company websites, conference programs, social profiles, press releases, job posts and code repositories all reveal names, roles, tools and projects. A job ad that lists the tools a team uses tells an attacker which login page to fake. People post their travel plans, which suit a message about an expense report or a missed flight.
What are the common goals?
Credential theft by a fake login page, malware delivery by an attachment or link, and fraud, where the message asks someone to change bank details or pay an invoice. In the fraud case, there may be no malicious file or link at all, so technical filters have little to catch.
What makes a message convincing?
It uses a real name and a plausible situation. It arrives at a believable time, for example just before a deadline. It asks for something small and routine. It may come from a compromised real account, so the sender address is genuine. It may mimic a vendor and reference a real purchase.
Urgency and secrecy are the tells that still hold. Requests to bypass the normal process, to keep the matter quiet, or to act within an hour deserve a second look.
Constructed example: the new supplier account
An accounts payable clerk receives a message that appears to be from a regular supplier's contact, mentioning the real purchase order number and asking to update the bank details because of an audit. The thread continues a real conversation, because the attacker has access to the supplier's mailbox. No link, no attachment. The clerk follows the process and calls the supplier on the number already on file. The supplier says they sent nothing. The loss is avoided because the process required a call back through a known channel for any bank detail change.
What controls help?
Process. Out of band verification for payments and changes to payment details. Two person approval above a threshold.
Authentication. Multi factor authentication, preferably phishing resistant, so a captured password cannot be reused. Mail authentication standards such as SPF, DKIM and DMARC reduce spoofing of your own domain.
Technical filters. Attachment and link scanning, and warnings on external senders.
Reduced exposure. Trim what you publish about roles and tools where practical.
Reporting. A one click way to report suspicious messages, with quick feedback. Do not punish people who report or who click and tell you.
Training. Short, realistic exercises, repeated, that teach checking the process, not guessing at text.
How to check or apply this
- Write down which actions in your company move money or grant access, and require a second check for each.
- Turn on multi factor authentication everywhere that supports it, starting with email and finance systems.
- Publish a verified phone list for key suppliers and executives.
- Configure SPF, DKIM and DMARC for your domains and monitor reports.
- Run a quarterly simulated spear phish against a small group, with leadership consent, and share lessons without blame.
- Review what your public job posts and staff pages reveal.
Quick check
Why is spear phishing harder to detect?
It is written for the target with real details, so the usual signs such as bad grammar and generic greetings are often missing.
What is the best control against payment fraud by email?
A call back to a known phone number before changing bank details, backed by two person approval above a set amount.
Sources
- CISA, Avoiding Social Engineering and Phishing Attacks
- MITRE ATT&CK T1566, Phishing
- MITRE ATT&CK T1566.001, Spearphishing Attachment
Last reviewed: 18 October 2026.
