Spear phishing is a highly targeted form of phishing in which the attacker researches a specific individual or company and crafts a message that references real names, projects or suppliers to appear legitimate.
Why it matters
Generic phishing is easy to spot; spear phishing is not, because it uses real context from LinkedIn, press releases or earlier breaches. It is a common first step in business email compromise and ransomware incidents. Finance, HR and executive assistants are frequent targets.
Example
An accountant receives an email that appears to come from the CEO, referencing a real acquisition and asking for an urgent wire to a new bank account. The sender domain differs by one character from the company domain.
Common mistakes
- Relying only on spam filters, since tailored messages often pass them.
- Skipping out-of-band verification such as a call to a known number for payment changes.
- Oversharing org charts and travel plans publicly, which feeds attackers research.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.