November 5, 2026
Updated: November 5, 2026
How targeted phishing, whaling and BEC work, what real cases show, how AI changes the lures and which controls and tests stop them.
Mohammed Khalil
What is spear phishing? It is a targeted phishing attack aimed at a specific person, team or organization, using researched details such as names, roles and vendors to make a fraudulent message look routine. The goal is usually to steal credentials, plant malware or get money or data sent to the attacker. Whaling is spear phishing aimed at executives, and business email compromise (BEC) is its payment-fraud form, with $3.05 billion in reported U.S. losses in 2025 per the FBI. The strongest defenses are DMARC, phishing-resistant MFA, out-of-band payment checks and fast reporting.
MITRE ATT&CK, the public knowledge base of attacker behavior, describes phishing as electronically delivered social engineering and calls the targeted form spearphishing: "a specific individual, company, or industry will be targeted by the adversary." The UK National Cyber Security Centre (NCSC) gives the same distinction in its phishing guidance: mass campaigns go to millions of inboxes, while spear phishing uses information about your staff or company to make the message more persuasive.
Three things make an attack spear phishing rather than ordinary phishing:
ATT&CK tracks the technique as Phishing (T1566) under Initial Access, with four sub-techniques: Spearphishing Attachment (T1566.001), Spearphishing Link (T1566.002), Spearphishing via Service (T1566.003, for example social media or chat) and Spearphishing Voice (T1566.004). When the goal is to collect information rather than gain access, ATT&CK uses a separate reconnaissance technique, Phishing for Information (T1598). Email is still the main channel, but the same targeted approach now arrives by text, phone, collaboration apps and video calls.
Spear phishing is one branch of social engineering. For the wider family of pretexting, vishing, baiting and tailgating, see our guide to what social engineering is.
The four terms overlap, which is why they are easy to mix up. Phishing is the broad category; spear phishing is the targeted form; whaling is spear phishing aimed at senior leaders; and BEC is a fraud outcome that is usually delivered through spear phishing or a compromised mailbox.
| Type | Who is targeted | How personal | What the attacker wants | Best first control |
|---|---|---|---|---|
| Phishing | Thousands or millions of inboxes | Generic brand lure | Passwords, malware installs | Email filtering and MFA |
| Spear phishing | One person or a small group | Researched personal or business context | Account access, data, a foothold for a larger attack | Phishing-resistant MFA |
| Whaling | Executives, board members and their assistants | Deal, legal, board, investor or press topics | Approvals, payments, strategic information | Executive protection and callback rules |
| Business email compromise (BEC) | Finance, payroll, procurement, real estate closings | A fake or hijacked trusted mailbox | A wire transfer or payment sent to the attacker | Out-of-band payment verification |
Whaling targets the people whose single "yes" moves money or unlocks sensitive decisions: chief executives, finance chiefs, general counsel and their assistants. Executives are attractive because a lot of information about them is public (interviews, filings, conference talks), their requests are rarely questioned, and they often have broad access. Whaling lures lean on authority and confidentiality: a "confidential acquisition," a regulator's inquiry, a board document that needs signing tonight. A related variant runs in reverse, where the attacker impersonates the executive to pressure an employee; the FBI and many organizations call this CEO fraud.
The FBI's Internet Crime Complaint Center (IC3) defines BEC as a scam targeting businesses or individuals that regularly perform wire transfers, carried out by compromising email accounts and other communication channels "through social engineering or computer intrusion techniques." Common forms include fake vendor invoices, changed bank details for an existing supplier, payroll diversion, fake attorney or title company instructions during a property closing, and gift card requests from a spoofed executive. BEC is where spear phishing turns directly into money, which is why it gets its own controls in the prevention section below. For trend data, see our business email compromise statistics.
The same targeted logic applies beyond email. Spear phishing by phone is vishing, by text message is smishing, and through QR codes is quishing. Our explainer on QR code phishing covers the QR variant in detail.
A spear phishing attack is a short project, not a single email. Breaking it into stages shows where defenders can interrupt it.
| Stage | What the attacker does | Control that breaks it |
|---|---|---|
| 1. Research | Collects names, roles, reporting lines, vendors and email formats from websites, social media, job posts and breach data | A smaller public footprint; role-based contacts for public roles |
| 2. Set-up | Registers a lookalike domain, spoofs a sender or takes over a real mailbox at a partner | DMARC enforcement on your domains; monitoring for lookalike domains |
| 3. Delivery | Sends a tailored email, text, chat, call or meeting invite, sometimes after weeks of harmless conversation | Filtering, external-sender banners, link and attachment analysis |
| 4. The ask | Asks the target to sign in, open a file, approve a request, pay an invoice or change bank details | Phishing-resistant MFA; callback verification for payments and access |
| 5. Impact | Uses the stolen session or credentials, installs malware, or moves the money | Fast reporting, session revocation, a bank recall request |
The research stage is where most of the personalization comes from. Attackers mine the same open sources a defender would review in an exposure assessment; our guide to what OSINT is explains those sources and how to shrink them. The set-up stage often uses domains that look almost identical to a real one, sometimes with lookalike characters from other alphabets, which our homoglyph attack explainer covers. Our guide to employees' digital footprints shows how public profiles feed these pretexts and which controls break the chain.
Two tactics deserve special attention because they defeat common advice. First, thread hijacking: ATT&CK notes that attackers insert the target into an existing email thread, so the message arrives from a real contact in a real conversation. Second, adversary-in-the-middle sign-in pages that relay the victim's password and one-time code to the real service in real time, capturing the session. Both make "check the sender" and "turn on MFA" necessary but not sufficient.
The cases below come from court records, government advisories and the victim organization's own account. Each one shows a different stage of the attack.
The July 13, 2018 indictment in United States v. Netyksho charged twelve officers of Russia's military intelligence agency (GRU). According to the indictment, conspirators targeted more than 300 people affiliated with the Clinton campaign, the DCCC and the DNC starting by at least March 2016. On or about March 19, 2016, they sent the campaign chairman an email spoofed to look like a Google security notification that told him to change his password through a shortened link. The instructions were followed, and on or about March 21 the conspirators stole more than 50,000 emails from the account. On April 6, 2016, they used an address with a one-letter deviation from a real campaign staffer's name to send links to more than thirty employees, disguised as a spreadsheet of polling results.
Lesson: a password-change lure plus a lookalike sender is enough when the account has no phishing-resistant MFA. These are allegations in an indictment; the defendants have not been tried.
CISA, the FBI, NSA and UK and Five Eyes partners published advisory AA23-341A on December 7, 2023, about Star Blizzard, a group the agencies assess as almost certainly subordinate to Russia's FSB. The advisory describes a slow approach: the group researches targets' interests and real contacts on social media and professional networks, impersonates those contacts or respected experts, and builds rapport over an extended correspondence before sending a link to a "document." The link leads to a fake sign-in page. The advisory says the group used an open-source adversary-in-the-middle framework to harvest credentials and session cookies and bypass two-factor authentication, then read mailboxes and set up forwarding rules. It also notes a preference for targets' personal email accounts, which sit outside corporate controls.
Lesson: patient pretexts beat "spot the typo" training, and code-based MFA can be relayed. Only phishing-resistant MFA stops the session theft.
The U.S. Attorney's Office for the Southern District of New York announced on December 19, 2019 that Evaldas Rimasauskas was sentenced to 60 months in prison for a BEC scheme that induced two U.S. internet companies to wire more than $120 million. He registered a Latvian company with the same name as a real Asian hardware supplier, and phishing emails posing as that supplier's staff redirected payments to his accounts. Our social engineering guide covers this case in more depth.
Lesson: BEC does not need malware. A trusted vendor relationship and a changed bank account are enough, unless payment changes are verified out of band.
Early in 2024, an employee at engineering firm Arup transferred $25 million after a video call with what appeared to be senior managers, all of them AI-generated deepfakes. In a World Economic Forum interview published February 4, 2025, Arup's chief information officer said none of the company's systems were compromised; people were deceived into believing they were carrying out genuine transactions.
Lesson: this is whaling in reverse. Seeing and hearing a familiar executive is no longer proof, so payment approvals need a verification step that a deepfake cannot complete.
The 2025 IC3 Internet Crime Report describes an April 2025 BEC incident in which a city government office in Oregon reported a loss of over $6 million. Because the FBI's Recovery Asset Team had already flagged the recipient account in an earlier complaint, the receiving bank questioned the transfer and the originating bank was able to recall the $6 million wire.
Lesson: speed matters. Reporting a fraudulent transfer to the bank and to IC3 immediately is the difference between a loss and a recall.
Spear phishing is hard to count on its own because victims report outcomes (a lost payment, a breached account) rather than techniques. The FBI's IC3 data is the most useful U.S. anchor:
These are reported complaints, so they undercount the real total. For broader trend data, see our phishing statistics and BEC statistics pages.
Generative AI does not invent a new attack. It removes the costs that used to limit spear phishing: research time, writing quality and the ability to impersonate a voice or face.
The FBI's December 2024 public service announcement I-120324-PSA lists the ways criminals use it: AI-generated text for spear phishing that corrects the grammar and spelling errors that once gave scams away, AI-generated profile photos and documents for fake personas, voice cloning to impersonate relatives or executives, and AI-generated video for real-time calls with supposed company executives. The 2025 IC3 report adds that chat generators "can quickly create official-sounding emails mimicking a company's CEO," and that voice cloning is used to request wire payments.
What changes for defenders:
What does not change: the attack still needs the victim to sign in somewhere, open something or move money. Controls that make those actions safe, such as phishing-resistant MFA and out-of-band payment verification, work the same against AI-written lures as against handwritten ones. For data on deepfake fraud, see our deepfake statistics.
Because spear phishing is personalized, the classic warning signs (bad spelling, a generic greeting) are often missing. Watch the request instead.
The illustrative example below is invented for this guide and shows how several red flags combine:
From: Dana Lee, CFO <dana.lee@yourcompany-finance.co>
Subject: Re: Q4 vendor true-up (confidential)
Hi Sam, following up on this morning's call. We need to settle the Northwind invoice today before the audit cut-off; their bank details changed last month, updated instructions attached. I'm in back-to-back board sessions, so please handle it without looping in AP and confirm by email once it's sent. Thanks, Dana
| Red flag | Where it shows up in the example |
|---|---|
| Sender domain is close to, but not exactly, your own | "yourcompany-finance.co" instead of the real domain |
| Urgency tied to a real deadline | "today before the audit cut-off" |
| A request to change payment details or bank accounts | "their bank details changed last month" |
| Secrecy or bypassing normal process | "confidential," "without looping in AP" |
| The requester is unreachable by normal channels | "back-to-back board sessions," "confirm by email" |
| Reference to a real event you cannot verify | "following up on this morning's call" |
Other red flags include a sign-in page reached from a link rather than your bookmark, an unexpected file-sharing link from a known contact, a reply-to address that differs from the sender, and a new contact who moves the conversation to a personal email address or messaging app. One red flag is enough to pause and verify through a channel you already trust.
Targeted messages are designed to look normal, so detection relies on behavior around the message, not just the message itself:
No single control stops targeted phishing. The NCSC's guidance warns that defenses lean too heavily on users spotting phishing emails and recommends a layered approach. The five layers below map to the attack stages above.
Publish SPF and DKIM for every domain that sends mail, then move DMARC from monitoring (p=none) to enforcement (p=quarantine, then p=reject), including domains you own but do not use for email. DMARC is now a Standards Track protocol: RFC 9989, published in May 2026, obsoletes the original RFC 7489, and records still begin with v=DMARC1. Large mailbox providers already expect it; Google's email sender guidelines have required SPF, DKIM and DMARC since February 1, 2024 for senders of more than 5,000 messages a day to Gmail accounts. DMARC stops exact-domain spoofing only, so add lookalike-domain monitoring and external-sender banners for everything else.
CISA's fact sheet on phishing-resistant MFA calls FIDO/WebAuthn and PKI-based authentication the "gold standard" and explains that one-time codes and push approvals remain vulnerable to phishing. NIST's SP 800-63B-4 (2025) requires phishing-resistant authenticators at its highest assurance level, requires services at the middle level to offer a phishing-resistant option, and requires federal agencies to use phishing-resistant authentication for their staff. Start with email, single sign-on, VPN, finance systems and every administrator and executive account. Pair it with protections against push bombing; our explainer on MFA fatigue covers that attack.
Write a rule that no one can break: any new payee, change of bank details, urgent executive payment request or request to reset MFA is confirmed by calling a number already on file, never a number in the message. The FBI's BEC prevention advice says to use secondary channels to verify requests for changes in account information. Add dual approval above a set amount and a short hold on first payments to new accounts. This one process control would have stopped most of the money cases above, including the deepfake call.
Give every user a one-click report button, triage reports quickly and thank the people who send them. Run short, specific training for the roles attackers target most: finance, payroll, executive assistants, help desk and executives themselves. Training should focus on the request patterns in the red flags table and on how to verify, not on spotting typos.
Prepare a playbook before you need it: who revokes sessions, who resets credentials and MFA, who searches all mailboxes for the same lure, who checks for new inbox rules and who calls the bank. Rehearse it in a tabletop exercise with finance and IT together.
Phishing simulations are useful when they measure how the organization responds, not how often individuals fail. The evidence on simple click-and-train programs is sobering. A randomized study of more than 19,500 employees at UC San Diego Health, presented at the 2025 IEEE Symposium on Security and Privacy and summarized by UC San Diego, found that embedded training after a simulated click reduced failure rates by only about 2%. Three in four users spent a minute or less on the training page, and click rates ranged from 1.82% to 30.8% depending on the lure. The researchers recommended putting more weight on technical controls such as two-factor authentication and password managers. Our security awareness training statistics compare this study with vendor benchmarks and Verizon's reporting data.
The NCSC adds a legal and cultural warning in its phishing guidance: since no one can spot every phishing email, punishing people for clicking on emails you sent "starts to resemble entrapment," and you should check with HR before running simulations.
Rules for an ethical program:
| Metric | What it tells you | Better direction |
|---|---|---|
| Report rate | How many recipients reported the lure | Higher |
| Time to first report | How fast the security team learns about a campaign | Shorter |
| Credential submission rate | How many reached the sign-in step (without storing passwords) | Lower |
| Control effectiveness | Whether MFA, banners and payment callbacks worked | More controls held |
| Click rate | How many opened the link; noisy and lure-dependent on its own | Lower, but never the only metric |
A simulation run by an internal team tests awareness. A social engineering penetration test goes further: it uses authorized, realistic spear phishing, vishing and pretexting scenarios to check whether your processes, MFA and reporting hold up, and that guide explains how to scope one, what rules of engagement to set and how to read the results without blaming staff.
If someone clicked a link, opened a file, entered a password or sent money, speed matters more than blame. Work through this list in the first hour:
Spear phishing is a phishing message written for a specific person or small group, using real details about them, their job or their company to look legitimate. The goal is usually to steal a login, plant malware or get a payment or data sent to the attacker.
Phishing is sent in bulk with a generic lure and relies on a small percentage of people falling for it. Spear phishing is aimed at chosen targets and uses research to make the message fit their work, so it is harder to spot and often aims for higher-value access or payments.
A whaling attack is spear phishing aimed at senior executives such as chief executives, finance chiefs and board members, or at their assistants. It uses authority and confidentiality, for example a confidential deal or a legal matter, to get approvals, payments or sensitive information.
Not exactly. Spear phishing is the delivery technique; BEC is a fraud outcome in which attackers use a spoofed or compromised business mailbox to redirect payments or obtain sensitive data. Most BEC attacks start with spear phishing or a stolen mailbox password.
Phishing-resistant MFA, such as FIDO2 security keys, passkeys or PKI smart cards, stops attackers from reusing stolen credentials, because the authenticator only works on the real site. One-time codes and push approvals help, but adversary-in-the-middle pages can relay them. MFA does not stop payment fraud, so pair it with out-of-band payment verification.
AI lets attackers write fluent, personalized lures at scale, create fake profiles and clone voices or faces for calls. The FBI recorded more than $30 million in 2025 business losses to BEC scams involving AI. Defenses that verify the request through a separate channel still work.
Report it to your security team right away, change the password and sign out of all sessions if you entered credentials, and tell the team whether you opened a file or approved anything. If money was sent, contact the bank immediately and file a complaint with the FBI at ic3.gov.
Spear phishing succeeds when one person, one process or one login gives way. Enforce DMARC, move high-risk accounts to phishing-resistant MFA, put a callback rule on every payment change and make reporting easy, then test whether those controls actually work under realistic pressure.
Start with our social engineering penetration testing guide to plan an authorized test of your people and processes. To test spear phishing as one entry point in a full attack scenario, DeepStrike's red teaming services include phishing, pretexting and user-targeted access scenarios as entry vectors.
Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
