In short
Spear phishing is a fraudulent email written for one specific person or role, using real details about their company to look legitimate. It isn't sent to thousands of inboxes, so it doesn't appear on reputation lists and spam filters barely catch it. It's stopped by comparing each message against the sender's and recipient's usual behavior, and by teaching the team to verify unusual requests.
What spear phishing is
Traditional phishing is a hook cast at thousands of people. Spear phishing targets just one: the person who handles payments, the executive assistant, the systems administrator. The message uses their name, their role and real details about the company.
When the target is a senior executive it's usually called whaling. And when the goal is diverting a payment, it becomes BEC fraud.
How an attack is prepared
- Research. The attacker checks the company website, LinkedIn, social media and news to figure out who's who.
- Pretext. They pick a believable story: an invoice from a real vendor, a document shared by a colleague, an HR notice.
- Infrastructure. They register a domain that looks like the company's or a vendor's, or use a real account they already compromised.
- Delivery. They send one or a few emails, during business hours and in the company's tone.
Why traditional filters let it through
A spam filter looks for patterns that repeat across mass campaigns. A spear phishing email is unique, is usually well written, and often has no attachments. If it comes from a freshly registered domain or a genuinely compromised account, it also won't appear on reputation lists. We explain this in why SpamAssassin doesn't catch targeted phishing.
Warning signs
- A sender writing for the first time, or a domain nearly identical to someone known.
- An unusual request: buying gift cards, changing bank details, sending a spreadsheet with personal data.
- Urgency and secrecy: "I need this before noon, don't mention it to anyone."
- A link to a document or a login page asking for your email password.
- A reply address (Reply-To) that differs from the sender's.
How to protect your team
- Verify through another channel any request for money, data or access, by calling a number you already have.
- Reduce public information about who approves payments or manages systems.
- Set up SPF, DKIM and DMARC so no one can send mail using exactly your domain.
- Use a filter that analyzes context. Clisec compares each message against the sender's and recipient's usual behavior, and inspects links and their destination pages before delivery.
- Make reporting easy: anyone should be able to flag a suspicious email without fear of getting it wrong.
Frequently asked questions
What's the difference between phishing and spear phishing?
Phishing is sent to many people with a generic message. Spear phishing is written for one specific person or role, using real information about their company.
Does spear phishing always include a link?
No. It's often just text asking for an action, like a payment or sending data, precisely to avoid triggering link and attachment filters.
What do I do if someone already replied?
If they handed over a password, change it immediately and check the mailbox's forwarding rules. If they made a payment, call the bank right away to try to stop it.
Protect every account on your server
Clisec compares each message against the sender's and recipient's usual behavior across your whole cPanel server, without changing MX records.