Spear phishing is a targeted form of phishing. Instead of sending the same message to a large number of people, the attacker writes to a chosen person, team or company. The message uses names, roles, projects or suppliers that make it look genuine. MITRE ATT&CK describes all forms of spearphishing as electronically delivered social engineering aimed at a specific individual, company or industry.

How it works

• The attacker researches the target through public sources, social media and leaked data.
• They craft a message that fits the target’s work, often sent from a spoofed or compromised account.
• The message carries a malicious attachment, a link to a fake login page, or a request to act.
• A successful click can install malware or hand over credentials.

Spear phishing aimed at senior executives is known as whaling. Phone and text variants are vishing and smishing.

Why it matters for defenders

Spear phishing is a common first step in intrusions, including ransomware and business email compromise. Email filtering, phishing-resistant MFA and staff who feel safe to report suspicious messages are key defenses. Leaked internal details, such as email lists or org charts, make targeting easier, so they are worth finding early.

Sources: MITRE ATT&CK T1566: Phishing, MITRE ATT&CK T1566.001: Spearphishing Attachment