What is whaling?
Whaling is spear phishing aimed at the most senior people in an organization: the CEO, CFO, general counsel, other executives and board members. The name plays on the idea of going after the biggest catch. Executives are worth extra research because they can approve large payments, they see strategy and merger information, and their accounts carry broad access. They are also sometimes exempted from controls that slow everyone else down, which makes a compromise easier to exploit.
How a whaling attack works
The attacker studies the target in depth. Annual reports, earnings calls, conference talks, interviews, board member lists and social media reveal the executive's priorities, travel schedule, assistants and outside advisers. The lure is then written to match an executive's actual workload rather than a generic employee's:
- A court summons or subpoena naming the company
- Board meeting materials that require a sign-in to view
- A shareholder complaint or regulatory inquiry
- Documents for a confidential acquisition
- A tax or compensation matter
Because executive assistants often manage the mailbox and calendar, attackers target them too. A successful whaling attack may capture the executive's credentials, install malware on a device with access to sensitive data, or set up a later fraud in which the attacker uses the executive's real account to request payments.
A whaling example
A CFO receives an email styled as a notice from a law firm, stating that the company has been named in a lawsuit and asking her to review the filing through a secure portal. The message names the company's real outside counsel, refers to a recent public dispute and arrives while she is traveling, as her public schedule showed. The portal is a copy of a document-sharing sign-in page. The researched detail and the executive target make this whaling.
Defending executives against whaling
- Give executives and their assistants short, dedicated briefings with examples written for their roles, and include them in phishing simulations instead of exempting them.
- Require phishing-resistant MFA on executive accounts.
- Apply payment controls that no single person can bypass: dual approval, callback verification to a known number and a holding period for new bank details.
- Publish a standing rule that executives never request wire transfers, gift cards or secrecy by email or text.
- Limit what executive biographies and assistants' contact details reveal publicly, and monitor for lookalike domains.
Whaling vs. spear phishing vs. business email compromise
Whaling is a subset of spear phishing, so both are technically correct when an executive is targeted, but whaling is the more specific term. The key question is who the target is. An email that impersonates the CEO and asks a payroll clerk for employee tax forms is not whaling: the CEO is the disguise and the clerk is the target, which makes it spear phishing used for business email compromise. Business email compromise is defined by its goal, fraud or data theft through trusted email, rather than by who receives the message.
Whaling on the CompTIA Security+ exam
Whaling appears under SY0-801 objective 2.5 with the other social engineering attacks. Scenario wording that points to it names a senior target, such as the chief executive, finance chief, legal counsel or a board member, and describes a lure tailored to that role. Common distractors are phishing (too broad), spear phishing (true but less specific), business email compromise (when the executive is only being impersonated) and vishing (when the question asks about a phone call as the method). The term also appears in A+ Core 2 (220-1202) objective 2.5.