A targeted form of phishing where attackers customize their fraudulent messages using personal information about the victim, such as their name, job title, colleagues, or recent activities.
A targeted form of phishing where attackers customize their fraudulent messages using personal information about the victim, such as their name, job title, colleagues, or recent activities.
Think you've been targeted?
Paste the suspicious content here for an instant analysis.
No signup · 6 detection layers · Results in seconds · Cmd+Enter
Unlike regular phishing that casts a wide net, spear phishing is precision-targeted. Attackers research their victims through social media, company websites, data breaches, and public records to craft highly personalized messages that are extremely difficult to detect.
Spear phishing is responsible for the majority of successful data breaches at organizations. Because the messages reference real colleagues, projects, and events, even security-aware employees can be deceived.
The investment attackers make in researching each target pays off — spear phishing has a significantly higher success rate than mass phishing campaigns, often exceeding 50% click-through rates.
The 2016 Democratic National Committee breach began with a spear phishing email to campaign chairman John Podesta. The email appeared to be a Google security alert about his account, and included his name and was styled exactly like a real Google notification.