When Phishing Gets Personal: Spear Phishing Explained
Standard phishing campaigns cast the widest possible net—sending identical malicious emails to millions of recipients hoping a fraction will click. Spear phishing is the precision evolution of this tactic: instead of generic bait, attackers craft highly personalized messages tailored specifically to a single target using open-source intelligence (OSINT) gathered from LinkedIn profiles, company websites, social media accounts, and even breach data dumps. The result is an attack that appears undeniably legitimate to the victim.
How Attackers Build a Spear Phishing Profile
Before launching a spear phishing campaign against a specific individual, threat actors perform systematic OSINT reconnaissance:
- LinkedIn Data Mining: Attackers identify the target’s job title, manager’s name, department structure, recent projects, and even the productivity tools used (e.g., Jira, Salesforce, Slack). This information is woven into the phishing email to make it appear to originate from an internal source.
- Social Media Scraping: The target’s Instagram, Twitter/X, and Facebook activity provides attackers with personal details—recent travel, family members’ names, hobbies—that add hyperrealistic social context to attack messages.
- Corporate Email Pattern Analysis: By identifying one corporate email address (e.g., john.smith@company.com), attackers can predict the email format for any employee at that organization, enabling convincing executive impersonation.
Whaling: When C-Suite Executives Are the Target
Whaling is spear phishing directed specifically at high-value corporate targets—CEOs, CFOs, general counsels, and board members. Because these executives have the authority to approve large wire transfers, sign vendor contracts, and access confidential strategic data, a single successful whaling attack can yield millions of dollars. The most common whaling vector in 2026 is Business Email Compromise (BEC): attackers impersonate a CEO via a spoofed email domain (e.g., ceo@company-corp.com instead of ceo@company.com) and instruct the finance team to urgently wire funds to a fraudulent account.
How to Protect Against Spear Phishing and Whaling
- Implement DMARC, DKIM, and SPF Email Authentication: These technical email authentication protocols prevent external attackers from spoofing your organization’s domain in outbound emails to deceive employees.
- Minimize Public OSINT Exposure: Review LinkedIn profile privacy settings. Avoid posting company project names, org charts, or internal tool mentions on personal social media.
- Establish Out-of-Band Verification for Wire Transfers: Any request to transfer funds or change vendor payment details must be verbally confirmed via a direct phone call to the requester using a pre-established number—never trusting contact information provided in the email itself.
For cybersecurity awareness, Android security guides, and social engineering defense resources, visit Android People.