Spear phishing
noun · also Spearphishing · MITRE ATT&CK T1566
Phishing aimed at a specific person or small group, using details about them to make the message credible enough to bypass suspicion.
Mass phishing casts a wide net. Spear phishing picks a target and does the homework first: the person's role, their manager's name, the vendors they work with, a project they posted about on LinkedIn. The result is a message that looks like normal work, sent at a plausible time, often from a lookalike or compromised account. When the target is a senior executive, it is sometimes called whaling.
MITRE ATT&CK splits the technique by delivery method: a malicious attachment (T1566.001), a link (T1566.002), a third-party service such as social media or a personal webmail account (T1566.003), and voice calls (T1566.004).
Example
A finance analyst receives an email from what appears to be the company's auditing firm, referencing the real quarter-end close and addressing them by name. The attached spreadsheet asks them to "enable editing" to view the figures, which runs a macro that installs a remote access tool.
Why it matters for a SOC analyst
Spear phishing is how many targeted intrusions start, and it slips past filters that look for volume. Treat a report from a high-value user, such as finance, HR, IT administrators or executives, with extra priority, and look for small details: a lookalike domain, a reply-to address that differs from the sender, or a first-time sender to your organization.
Related terms
- Phishing
A message that impersonates someone trustworthy to trick the recipient into clicking a link, opening a file, sharing credentials or sending money.
- Business email compromise
Fraud in which an attacker impersonates or takes over a trusted business email account to redirect payments or obtain sensitive data.
- Social engineering
Manipulating people, rather than systems, into giving up information, access or money by exploiting trust, urgency, authority or helpfulness.
- Threat intelligence
Information about threats and threat actors, collected and analyzed so that an organization can make better security decisions.