At 8:41 on a Tuesday morning, 640 employees at a regional hospital receive an email from "IT Service Desk" warning that their mailboxes will be locked at noon unless they re-validate their accounts. Nineteen people click the button. Four type their passwords into the page that opens, and one of the four runs payroll.
Year after year, breach investigations rank phishing and stolen credentials among the most common ways attackers first get in. On the CompTIA Security+ SY0-801 exam, phishing, spear phishing and whaling appear under objective 2.5 as social engineering attacks, and because 2.5 is a scenario objective, you'll be shown a message or an incident and asked to read its signs. This lesson covers how the three variants differ, the psychological levers they pull, the clues in a message and its headers, and what an analyst does when a user reports one.
Phishing uses a convincing message to make the victim do the attacker's work
Phishing is social engineering delivered by email: a message that impersonates someone the recipient trusts and persuades them to take an action that helps the attacker. The action is usually one of four things:
- Enter credentials on a fake sign-in page.
- Open an attachment or download that installs malware.
- Send money or change payment details.
- Reply with sensitive information, such as tax forms or customer records.
Mass phishing is cheap. An attacker can send the same lure to a hundred thousand addresses, and a response rate of a fraction of a percent still yields hundreds of victims. The lures are generic because they have to fit everyone: a shared document, a voicemail notification, a package that couldn't be delivered, a password that expires today.
The landing pages are good copies. Phishing kits sold on criminal forums clone a company's real sign-in page, logo and background image included, and some act as a relay between the victim and the real site. These adversary-in-the-middle kits pass the victim's password and one-time code through to the genuine service and keep the session cookie that comes back, which lets the attacker skip MFA entirely. Phishing-resistant MFA, such as FIDO2 security keys and passkeys, defeats this because each credential is bound to the real site's domain, so the browser and authenticator won't use it on a lookalike. MFA bypass techniques get their own lesson in the credential attacks section.
Don't count on spelling mistakes to give phishing away. Attackers use AI writing tools and translation services, and many lures read better than genuine corporate email.
Spear phishing and whaling narrow the target and raise the payoff
Spear phishing is phishing aimed at a specific person or small group, built from research about them. The attacker reads LinkedIn profiles, the company website, press releases and conference agendas, and sometimes collects out-of-office replies to learn names, roles and reporting lines. The result mentions a real project, a real manager or a real vendor, and it is far more convincing than a generic lure.
Whaling is spear phishing aimed at senior executives: the CEO, CFO, general counsel or board members. Executives are worth the extra effort. They can approve large payments, they see strategy and deal information, and they are sometimes exempted from controls that slow everyone else down. Whaling lures match their work: a subpoena, a shareholder complaint, board meeting materials, a tax matter or a confidential acquisition. Because assistants often manage an executive's mailbox, attackers target the assistants too.
| Variant | Who receives it | How it is built | Typical lure |
|---|---|---|---|
| Phishing | Large numbers of people | Generic, one message for all | Password expiry, shared file, delivery notice |
| Spear phishing | A named person or small group | Researched details about the target | Invoice from a real vendor, note "from" the target's manager |
| Whaling | Senior executives and board members | Researched and tailored to executive duties | Subpoena, board pack, confidential deal |
On the exam, the deciding clue is who was targeted. A message sent to every employee is phishing. A message to the accounts payable team that names their real supplier is spear phishing. A message to the CFO about a lawsuit naming the company is whaling. Whaling is a kind of spear phishing, so when both appear in the answers and the target is an executive, whaling is the more specific and better answer. An email that impersonates the CEO and is sent to a payroll clerk isn't whaling: the CEO is the disguise, and the clerk is the target.