CYBER-09-003-P · Primer — Spear Phishing & Whaling

The idea in one sentence

Spear phishing is a scam message crafted for one specific person using real details about them, and whaling is that same attack aimed at a high-value target such as an executive.

Why it exists

Ordinary phishing is a net cast wide: the same clumsy message hits a million inboxes hoping a few people click, so filters and awareness training catch most of it. Spear phishing exists because attackers learned that a single, tailored message pays far better against a worthwhile target. A note that already knows your name, your manager, and the vendor you paid last week does not read like spam — it reads like work, and that familiarity is exactly what disarms your suspicion. Whaling narrows the aim further to the people whose approval moves the most money or unlocks the most access.

How it works

The attack comes together in four beats. First, reconnaissance: the attacker mines LinkedIn, the company site, press releases, and past data breaches to learn your role, your reporting chain, and who you do business with. Second, the pretext: they impersonate someone you already trust — a boss, a supplier, the IT desk — and reference something true to prove it. Third, the ask: wire this invoice, change these bank details, buy gift cards, approve this login, open this attachment — always something with real consequences. Fourth, the pressure: it is urgent and confidential, and conveniently the person you would check with is unreachable, so you act now and ask later. A concrete example: an email to accounts payable uses the real CFO's name and a genuine ongoing deal to request that a supplier payment go to a new bank account — the details check out, so it gets paid.

The one gotcha

The very personalization that makes the message convincing is also why your spam filter waves it through — generic filters are tuned for generic spam (bad grammar, sketchy links, mass sends), and a clean, tailored note from a plausible sender has none of those signals. So flip the logic: high personalization on a high-stakes request is not proof it is real — it is the tell to slow down. The concrete defensive move is out-of-band verification: for any request to move money, change bank details, or hand over credentials, confirm it through a second channel you already trust — call the person on a number you look up yourself (never the one in the email), walk to their desk, or ask in a channel the sender does not control.

See it (visualization plan)

A CompareScene-style contrast opens on mass phishing ("one message, a million inboxes") versus a spear ("one person, carefully aimed"). A ChainScene walks the four beats — recon → pretext → ask → pressure — then a LayersScene shows the filter letting the tailored note pass while blocking crude spam. The defense lands as a TilesScene: "pause on money / credentials / bank-detail asks → verify on a second channel → number you look up, not the one in the email."

See it — A simple flowchart showing the four steps of spear‑phishing and whaling attacks.

flowchart LR
A["Reconnaissance"] --> B["Pretext"]
B --> C["Ask"]
C --> D["Whaling"]

The one-line takeaway

Verify high-stakes asks, even when they look legitimate.

Where you'll meet it

You will meet this in finance and payments fraud (business email compromise redirecting supplier payments), in help-desk and password-reset workflows, and in any inbox that has authority worth hijacking. CISA publishes guidance on recognizing and reporting it, and MITRE ATT&CK tracks it as technique T1566.001, Spearphishing Attachment — the same pattern behind a large share of real-world intrusions.

Named concepts: spear phishing, whaling