What Is Spear Phishing? The Targeted Attack That Bypasses Every Technical Control

The attack that is written specifically for you.

A finance director receives an email from what appears to be the company's CEO. The email references a real acquisition the company is pursuing — one that has not been publicly announced. The tone matches the CEO's writing style: terse, direct, no pleasantries. The email asks the finance director to process an urgent wire transfer to a solicitor handling the deal, and includes a PDF attachment with the payment details. The email address is one character different from the CEO's real address — an 'rn' where an 'm' should be, invisible at a glance. The PDF contains a link to what appears to be a secure document portal. The portal is the real Microsoft 365 login page, relayed through an adversary-in-the-middle proxy that captures the finance director's credentials and authenticated session token the moment they sign in.

This is spear phishing. Not a bulk campaign sent to ten thousand inboxes hoping someone clicks. A targeted, researched, personally crafted attack directed at a specific individual, using information gathered about them, their organisation, their role, and their current activities to create a pretext that is almost indistinguishable from legitimate communication. The attacker knew the target's name, their position, their CEO's name and writing style, the existence of an undisclosed acquisition, and the email format the organisation uses. All of that intelligence was gathered before a single email was composed.

Spear phishing is the most common initial access vector used by advanced threat actors — state-sponsored and criminal alike. APT1 used it to compromise 141 organisations across 20 industries over a decade-long campaign. APT35 used it to target journalists and academic researchers studying Iranian policy, building rapport over weeks before delivering payloads. APT42 created elaborate fake personas and maintained months-long email correspondence before sending a single malicious link. Scattered Spider used it alongside helpdesk social engineering and MFA fatigue to breach MGM Resorts and Caesars Entertainment. LAPSUS$ used it as the first step in compromising Uber. The Picus Red Report 2026 documents that credential theft now features in nearly one in four attacks — and spear phishing is the primary method by which those credentials are harvested. The technique has persisted for over two decades not because defenders lack technology, but because it exploits the one vulnerability that cannot be patched: human trust.

Phishing versus spear phishing — volume versus precision.

The terms are often used interchangeably, but the operational difference between bulk phishing and spear phishing is enormous — and understanding it is essential for defence, because the controls that stop one are largely ineffective against the other.

The defensive implication is critical: the technical controls that are effective against bulk phishing — spam filters, URL reputation databases, known-bad signature lists — are far less effective against spear phishing. A spear phish uses a newly registered domain with no reputation history, references real people and real events that pass plausibility checks, and may use a legitimate email service or compromised account that passes all authentication checks. The attack is designed from the ground up to bypass the specific defences the target organisation has deployed. This is why organisations that achieve near-zero click rates on generic phishing simulations still get breached through targeted spear phishing — they are measuring resilience against the wrong threat.

How attackers build the profile that makes the email convincing.

The quality of a spear phishing attack is directly proportional to the quality of the reconnaissance that precedes it. Before composing a single email, the attacker gathers intelligence about the target individual and their organisation — and most of that intelligence is freely available from public sources. The reconnaissance phase is not optional. It is what distinguishes spear phishing from bulk phishing, and it is what makes the resulting emails so difficult for both humans and technology to identify as malicious.

The entire reconnaissance phase can be completed in hours using only publicly available information. No technical exploitation is required. No laws are broken during the intelligence gathering. The attacker simply reads what the target and their organisation have published — and uses it against them. This is why reducing your OSINT footprint is a defensive measure, and why social engineering assessments should always include a reconnaissance phase that demonstrates exactly what an attacker can learn about the organisation before sending a single email.

How the email gets through your defences.

A well-crafted spear phishing email is not merely convincing to the human recipient — it is engineered to bypass the specific email security controls deployed by the target organisation. The attacker considers and addresses each layer of technical defence, ensuring the email reaches the inbox where the human target can engage with it.

The pattern is consistent: each layer of defence was designed to stop untargeted attacks at scale. A spear phish is neither untargeted nor at scale — it is a single, precision-crafted message designed to pass every check. This does not mean these defences are worthless — they remain essential for stopping the vast majority of phishing attempts. But it does mean that no combination of email security controls alone can guarantee that a well-crafted spear phish will not reach an inbox. Defence must extend beyond the email gateway.

What the attacker delivers when you engage with the email.

The spear phishing email is the delivery mechanism. What it delivers — the payload — determines the impact. Modern spear phishing campaigns use several payload types, often in combination, and the choice of payload reflects the attacker's objective, the target's environment, and the defences they need to evade.

When the target is the most powerful person in the room.

Two specialised variants of spear phishing deserve particular attention because of their outsized financial and strategic impact.

Whaling targets senior executives — CEOs, CFOs, board members, managing directors, general counsel. These individuals have the authority to approve large financial transactions, access the most sensitive corporate information, and override standard procedures. They are also frequently the least likely to follow security policies — using personal devices, requesting exceptions to MFA requirements, and operating with a sense of urgency that discourages verification. A successful whaling attack against a CFO can result in direct financial losses measured in millions from a single fraudulent transaction. The term reflects the scale of the prize: the attacker is not fishing for any catch — they are targeting the biggest fish in the organisation.

Business Email Compromise (BEC) takes whaling further still. Rather than impersonating an executive via a lookalike domain, the attacker compromises the executive's actual email account — often through a prior spear phishing credential harvest using an AitM proxy. Once inside the real mailbox, the attacker monitors email conversations silently, identifies pending transactions (payments to suppliers, deal closings, invoice settlements), studies the communication patterns and writing style, and at precisely the right moment sends an email from the genuine account requesting that payment details be changed or an urgent transfer be processed. Because the email comes from the real account, passes every authentication check, matches the executive's writing style, and references a real transaction the finance team is already expecting, even cautious, well-trained finance teams comply. The FBI's Internet Crime Complaint Centre reports that BEC has caused greater cumulative financial losses than any other category of cybercrime — global losses exceeding $50 billion since tracking began. This is not a technology failure. Every technical control works exactly as designed. The email is authentic. The account is genuine. The authentication is valid. The failure is human — a process that permits high-value financial transactions based on email authority alone.

How nation-state groups weaponise spear phishing.

Every major APT group documented in the threat intelligence literature uses spear phishing as a primary or significant initial access vector. The table below draws from groups we have profiled in our threat intelligence series, demonstrating the consistency of the technique across different nations, motivations, and operational objectives.

The common thread across all these actors — spanning three different nations and motivations ranging from state espionage to financial extortion — is that spear phishing remains the preferred initial access vector. Not because more technically sophisticated methods are unavailable, but because spear phishing works more reliably, more repeatedly, and at lower cost than exploiting software vulnerabilities. A zero-day exploit costs hundreds of thousands of pounds to develop and is burned once used. A spear phishing email costs hours of research and can be adapted and reused indefinitely.

Spear phishing in the ATT&CK framework.

MITRE ATT&CK classifies spear phishing under the Initial Access tactic (TA0001) with three distinct sub-techniques, reflecting the different delivery mechanisms attackers use. Understanding these classifications helps organisations map their defences to specific attack vectors and identify gaps in coverage.

From email to full compromise — a realistic walkthrough.

Understanding spear phishing in isolation is insufficient. The email is step one in an attack chain that, left undetected, leads to full organisational compromise. This walkthrough demonstrates the complete lifecycle — from reconnaissance through objective completion — using techniques documented from real APT operations and our own engagement experience.

Every step in that chain used documented, repeatable techniques. No zero-day exploits. No custom malware. No exceptional technical skill beyond competent OSINT and infrastructure setup. The DMARC misconfiguration enabled the domain spoof. The AitM proxy defeated MFA. The LinkedIn post provided the pretext. The Friday afternoon timing reduced scrutiny. Six distinct detection opportunities existed and were missed — not because the technology was absent, but because it was not configured, not monitored, or not designed to detect this specific attack pattern.

How we simulate spear phishing during engagements.

When authorised to conduct social engineering assessments, our approach replicates the methodology of real threat actors — because testing against unrealistic simulations produces unrealistic results. An assessment using a generic 'Your password will expire' template tells you nothing about your organisation's resilience against the attacks that actually breach organisations.

Layered defence against an attack that targets every layer.

No single control can prevent spear phishing. The attack is specifically designed to bypass individual defences. Effective protection requires layered defence where each control reduces the probability of success at its stage — and failure at one layer does not mean failure overall. The objective is not to make spear phishing impossible (it is not), but to ensure that the attack chain is disrupted before the attacker achieves their objective.

Why this is not a technology problem with a technology solution.

Spear phishing is fundamentally a human problem. The technology is the delivery mechanism, but the vulnerability being exploited is trust — the willingness of a human being to act on a request that appears to come from a trusted source. No email security product, however sophisticated, can make the determination that a particular request from a particular sender about a particular transaction is fraudulent when the email is technically legitimate, properly authenticated, and contextually plausible.

This does not mean technology is irrelevant — every layer of technical defence reduces the probability that a spear phish reaches a human inbox. But it does mean that any defensive strategy that relies exclusively on technology will fail. The organisations with the strongest resilience against spear phishing are those that combine technical controls with a culture of verification: where questioning unexpected requests is encouraged rather than seen as obstructive, where reporting suspicious communications is rewarded rather than punished, where financial processes include human verification steps that cannot be bypassed by email authority alone, and where senior executives are subject to the same security policies as everyone else — because they are the most valuable targets, not the least likely to be attacked.

The helpdesk deserves particular attention. Across our engagements, the helpdesk is consistently the weakest human link in the defensive chain — trained to be helpful, authorised to reset passwords and MFA tokens, and rarely trained to resist the level of social engineering that a targeted attacker will employ. Scattered Spider's breach of MGM Resorts began with a phone call to the helpdesk. Strengthening helpdesk verification procedures — requiring callback verification to a known number, implementing challenge questions that cannot be answered from OSINT, and restricting the scope of changes that can be made via phone — is one of the highest-impact defensive investments an organisation can make against both spear phishing and its voice-based equivalent.

The bottom line.

Spear phishing is the most successful initial access technique in the threat landscape — and it has held that position for over two decades. It is used by every major APT group, every sophisticated criminal operation, and every competent red team. It succeeds because it exploits human trust rather than software vulnerabilities, because it is crafted to bypass the specific technical controls the target organisation has deployed, and because the reconnaissance required to make it convincing is freely available from public sources that the target organisation and its employees publish themselves.

The defence is not a single product, a single training programme, or a single policy. It is a layered strategy that combines email authentication at enforcement to prevent domain spoofing, advanced email security to detect suspicious content and links, phishing-resistant MFA to mitigate credential theft when users click, targeted awareness training to strengthen human judgement against realistic attacks, a reporting culture that rewards vigilance and enables rapid response, procedural controls for high-risk transactions that cannot be bypassed by email authority alone, post-delivery detection and response for when — not if — preventive controls fail, and ongoing reduction of the public information that enables attackers to craft convincing pretexts in the first place.

The most important defensive insight is this: a spear phishing email that reaches an inbox is not a failure of security. It is an expected event in any realistic threat model. The failure is when the email reaches the inbox, the user engages with it, the credentials or session tokens are harvested, the attacker establishes persistence, moves laterally, and achieves their objective — and nobody along that entire chain, from the user to the email platform to the SOC, identifies or responds to the compromise before it is too late. Every layer of defence that delays, detects, or disrupts that chain reduces the probability of catastrophic outcome. No single layer eliminates the risk. Together, they make the attacker's job materially harder — and in offensive security, harder means slower, and slower means more likely to be detected.