Spear Phishing

Before sending, the attacker gathers details about the target, for example from social media profiles, company websites, and internet activity, and builds a customized message. Spear phishing relies on social engineering, using details the victim finds believable as coming from a trusted source. AI lets attackers gather and analyze publicly available data on targets and write highly personalized messages.

Whaling is spear phishing aimed at senior executives or other high-profile recipients with privileged access and authority, often to push through unauthorized payments or wire transfers. Staff who can access sensitive information, manage financial assets, or administer IT systems are of greater interest to attackers and may be the target of a sophisticated spear phishing campaign. A message that succeeds can lead to stolen credentials or installed malware.

Spear phishing is harder to detect than ordinary phishing, and training alone cannot teach users to spot every message. The NCSC recommends limiting what the organization's website reveals that could help attackers, particularly about high-profile staff, a digital footprint policy for all users, and extra support for the staff most likely to be targeted. Other layers include anti-spoofing controls on the organization's email domains, multifactor authentication, and verifying unexpected requests through a separate channel.