Spear Phishing Explained: How Targeted Attacks Reach Employees

A generic phishing email tries to convince as many recipients as possible. A spear phishing email is built around a particular person, role or organisation. It may reference an actual supplier, manager, purchase order, event or internal workflow—details that make the request feel credible.

The key risk is confusing accurate context with authentic identity. A message can contain real information and still be malicious.

What is spear phishing?

Spear phishing is a targeted form of phishing in which an attacker tailors a deceptive message to its intended recipient. The objective may be credential theft, malware delivery, confidential-information disclosure or unauthorised payments.

Unlike a broad campaign using generic greetings, targeted attacks may use a recipient's name, team responsibilities and the organisation's routine communications. The information can come from public company pages, social profiles, compromised conversations or other exposed sources.

Three examples employees may encounter

Finance: a revised supplier invoice. An apparently familiar supplier claims its bank details have changed. The message cites a genuine invoice or project, making the unusual payment instruction easier to overlook.

HR: an updated employee document. A message appears to come from a manager and requests access to a file containing payroll information, followed by a link to an unfamiliar sign-in page.

Executive office: a confidential request. Someone impersonating leadership asks an assistant to share a sensitive document or purchase gift cards without following normal approvals.

These scenarios are illustrations, not reports of specific incidents. The BEC wire fraud playbook explores the financial risks of executive and supplier impersonation in more detail.

How AI affects targeted phishing

AI tools can assist with drafting messages in natural language, adapting tone and creating different variants. This makes traditional clues such as poor grammar or awkward wording less dependable.

Training therefore has to address the requested action, not only the style of the email. Ask whether the sender is authorised, whether the request matches policy and whether verification occurred through a reliable channel. PhishSheriff's AI-generated phishing guide outlines the change this creates for awareness programmes.

A simple prevention checklist

• Treat an unexpected payment, access or credential request as a verification event, even when the message looks professional.
• Check the full sender address and destination website, but do not assume a familiar display name is trustworthy.
• Use a known number or an existing approved channel to confirm a material change.
• Open important services through established bookmarks or applications instead of new sign-in links.
• Apply multifactor authentication, ideally phishing-resistant methods where supported.
• Report suspicious or unusual requests promptly, including attempts that did not result in a click.

Reducing unnecessarily exposed role and contact details can make targeted attacks harder to tailor. Organisations can also protect their domains with appropriate SPF, DKIM and DMARC controls, while recognising that these do not stop every lookalike-domain or compromised-account attack. See the DMARC implementation playbook.

Test the decisions most relevant to your teams

A simulation programme should not depend only on obvious, generic lures. Design authorised exercises using believable but safe scenarios for the teams involved. Track validated interactions and reporting, provide immediate coaching where useful, and assess improvement at later intervals.

PhishSheriff's AI phishing simulation offering supports this approach alongside awareness and human risk analytics.

Frequently asked questions

What is the difference between phishing and spear phishing?

Phishing is the broad category; spear phishing is tailored to a specific target, role or organisation.

Can a spear phishing email come from a real account?

Yes. Attackers can misuse compromised accounts or conversations, which is why familiar sender details alone are not enough.

Does DMARC prevent spear phishing?

DMARC can help protect against certain direct-domain spoofing attempts, but it does not eliminate lookalike domains, malicious links or compromised legitimate accounts.