How spear phishing works
Attackers gather information from company websites, social media, press releases and prior breaches. They then craft a message that mentions real colleagues, vendors or projects and impersonates a trusted sender.
The email may carry a malicious attachment, a link to a credential-harvesting page or a request to change payment details. Because few identical messages are sent, signature-based filters often miss it. Attackers may also compromise a real supplier mailbox first and reply inside an existing conversation, which makes the fraudulent message appear completely normal to everyone involved.
Why it matters for Canadian organizations
Spear phishing is a common starting point for ransomware, data theft and fraud. A single compromised mailbox can expose client information, contracts and financial approvals across the organization.
Canadian organizations that handle personal information must assess breaches under PIPEDA and, in Quebec, Law 25. Federally regulated firms also face OSFI expectations around third-party and operational risk, where impersonation of vendors is a frequent theme. The cost of a single successful message can be large, covering fraudulent transfers, incident response, legal advice, notification and lost productivity while accounts are reset and systems are checked.
How to defend against it
Deploy advanced email security that checks sender reputation, impersonation and link behavior, and enable multi-factor authentication everywhere so stolen passwords alone are not enough. Configure SPF, DKIM and DMARC for your domains.
Train staff with simulations that mirror real targeted lures, and require out-of-band verification for payment or credential requests. Encourage fast reporting and have a playbook to pull malicious messages from all mailboxes. Review mailbox rules and forwarding settings for unauthorized changes, since attackers often hide in a compromised account by quietly redirecting or deleting messages.
Frequently asked questions
What is the difference between phishing and spear phishing?
Phishing is sent in bulk to many recipients with generic content. Spear phishing is aimed at a chosen target and customized with personal or organizational details, which makes it more convincing and harder for filters and people to spot.
What is the difference between spear phishing and whaling?
Whaling is spear phishing aimed at senior executives or other high-value individuals. Both are personalized, but whaling messages typically mimic legal, financial or board matters and aim for large payments or highly sensitive data. Both rely on careful research.
How can I recognize a spear phishing email?
Look for unexpected requests, urgency, slightly altered sender addresses, mismatched links and requests to bypass normal process. Verify through a separate channel, such as a phone call to a known number, before acting or clicking. Context shapes the right response each time.
Related service: Phishing simulation