Spear Phishing

Spear phishing is a targeted social engineering attack designed to persuade a specific person or group to reveal credentials, approve access, or run malicious content. It differs from broad spam because the message is tailored to the target’s role, tools, or business context.

Expanded Definition

Spear phishing is a precision social engineering technique that uses context, urgency, and credibility to manipulate a specific target into taking an action that benefits the attacker. In security operations, it often serves as the delivery path for credential theft, malware, business email compromise, or unauthorised payment approval. The attacker may impersonate a colleague, supplier, executive, or trusted service, and the message is usually shaped around the target’s role, current projects, or known relationships.

The term is sometimes used loosely to describe any phishing email, but that broad usage misses the defining feature: the message is tailored to a known person or narrowly defined group. That distinction matters because targeted lures are more persuasive and often bypass generic awareness training. Guidance from the NIST Cybersecurity Framework 2.0 is useful here because it frames the need for governance, awareness, and incident response as part of a broader risk management approach. The most common misapplication is calling every suspicious email spear phishing, which occurs when the message is generic rather than specifically tailored to the recipient.

Examples and Use Cases

Implementing defences against spear phishing rigorously often introduces user friction, requiring organisations to weigh stronger verification against the time cost of extra checks and approvals.

• A finance employee receives a message that appears to come from the CFO requesting an urgent wire transfer, with wording that mirrors an active acquisition or quarter-end process.
• A developer gets an email pretending to be from an internal platform team asking them to sign in to a fake OWASP-style login page to “restore access” to a code repository or cloud console.
• An executive assistant is asked to review a shared document that installs malicious payloads after the user approves a permissions prompt.
• A supplier impersonation email asks accounts payable to update bank details, exploiting business process familiarity rather than technical vulnerability.
• A security team uses CISA phishing guidance to run simulations, train reporting behaviour, and validate mailbox controls after seeing repeated impersonation attempts.

In practice, spear phishing is not limited to email. It can arrive through collaboration platforms, SMS, voice, or AI-assisted message generation, which is why targeted social engineering should be assessed across all channels where trust is established. The quality of the pretext, not the delivery medium, is what often determines success.

Why It Matters for Security Teams

Spear phishing is important because it converts human trust into access, and that can undermine even strong technical controls when the attacker reaches a privileged or high-impact account. For identity and access teams, the threat often shows up as credential reuse, consent abuse, session hijacking, or approval of malicious workflows. For NHI governance, the same pattern can be used to steal API keys, tokens, or service account secrets from developers and platform operators, creating non-human identity compromise that is harder to detect than a stolen password.

Security teams need to treat spear phishing as both a people risk and an access risk. Detection, hardening, and response should cover identity proofing, conditional access, phishing-resistant authentication, mailbox filtering, and reporting workflows. The concept also intersects with agentic AI because AI-generated lures can be highly personalised and operationally scalable, which raises the volume and plausibility of attacks. Organisations typically encounter the full business impact only after a fraudulent approval, account takeover, or downstream abuse, at which point spear phishing becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What is phishing-resistant authentication and how does it relate to NHI security?
• How should security teams respond to voice phishing that targets Okta accounts?
• Why do MFA and password resets fail to stop consent phishing?
• What is the difference between credential phishing and consent phishing?