What is spear phishing?
Spear phishing is a targeted form of phishing. Instead of sending one generic lure to thousands of addresses, the attacker picks a named person or a small team, researches them, and writes a message that fits their real work. It might mention an actual project, a real manager, a supplier the company pays every month or a conference the target just spoke at. Because the details are accurate, the message does not feel like an attack, and the usual advice to look for generic greetings or clumsy wording no longer helps.
The goal is the same as any phishing message: get the target to enter credentials on a fake sign-in page, open a malicious attachment, change payment details or send sensitive data.
How attackers research and build the lure
Most of the research is open-source intelligence. Attackers read LinkedIn profiles, company websites, press releases, job postings and social media to learn names, roles, reporting lines and vendors. Out-of-office replies reveal who is traveling and who covers for them. Data from earlier breaches can add personal details.
The message is then built around a believable reason to act: an invoice from a known vendor, a document shared by a coworker, a request that seems to come from the target's manager. Some campaigns send from a lookalike domain one character off from the real one; others come from a genuinely compromised account at a partner, which passes email authentication checks.
A spear phishing example
An accounts payable specialist receives an email that appears to come from a regular supplier's billing contact, using the contact's real name and the supplier's usual invoice format. It says the supplier has moved banks and asks that the next payment go to a new account. The sender domain differs from the real one by a single letter. Nothing in the message is generic: the attacker learned the supplier's name from a public case study and the contact's name from LinkedIn. The deciding clue is that the message targets one role with researched details.
How to defend against spear phishing
- Role-based awareness training for finance, HR, IT administrators and executive assistants, with realistic simulations drawn from their own work.
- Email authentication (SPF, DKIM and DMARC at an enforcing policy) to stop exact-domain spoofing, plus monitoring for newly registered lookalike domains.
- External-sender tags and first-time-sender warnings in the mail client.
- Phishing-resistant MFA, such as FIDO2 security keys or passkeys, so a stolen password alone does not open the account.
- Out-of-band verification for any request to move money or change bank details, using a phone number already on file.
- An easy report button, so one reported message lets the security team find and purge it from every mailbox.
Spear phishing vs. phishing vs. whaling
Phishing is the broad category: deceptive messages sent to many people with generic lures. Spear phishing narrows the target to a specific person or group and uses researched details. Whaling is spear phishing aimed at senior executives, such as the CEO, CFO or general counsel. Business email compromise overlaps with all three but is defined by its goal, usually fraudulent payments or data theft, often with no link or attachment at all.
Spear phishing on the CompTIA Security+ exam
Spear phishing falls under SY0-801 objective 2.5, which covers recognizing social engineering attacks from a scenario's details. The wording that points to it describes research into a particular person or team, real names or projects in the message, or a lure sent to a small group such as the payroll staff. If the target is a senior executive, whaling is the more specific answer. If the message goes to every employee with a generic lure, the answer is phishing. If it arrives by text message or phone call, the channel names it instead: smishing or vishing. The term also appears in A+ Core 2 (220-1202) objective 2.5.