Spear Phishing - Targeted Email Attack Tactics

About 2 min read

Spear phishing is a targeted phishing attack aimed at a specific individual or organization. Unlike ordinary phishing sent to large numbers of unspecified recipients, the attacker researches the target's personal information, affiliated organization, and job duties in advance, then sends a highly convincing, customized email. Its success rate is high, and it is frequently used as an entry point for intrusion into companies.

What Decides How Far the Damage Spreads After It Is Opened

An email built on prior research arrives in a state where the recipient can judge it to be natural against the context of their own work. There is therefore a side of the problem that starts from the premise that one will be opened sooner or later and asks what is decided from that point on. One factor is the breadth of the privileges held by the device that opened it. What comes within reach immediately after an intrusion is limited to what that device can reach. If a shared storage area carries broad write permissions, an intrusion that began on a single machine extends as it stands to several places. Narrowing privileges to what the work actually requires is unglamorous housekeeping in normal times, but at this point it appears as the ceiling on how far the damage spreads. The other factor is how long it takes the person who opened it to speak up. In most cases that person already senses at the time that something is wrong. The interval before that sense turns into a report determines the hour at which a response can begin. What influences that interval is less the existence of a written procedure than the visible prospect of how the report will be handled. Where the matter is treated as personal negligence and reflected in an individual assessment, the pull is towards waiting until one is certain, and the reach of the intrusion widens in the meantime. Reducing how often something is opened and shortening the time after it has been opened are separate efforts, and the second does not depend on how well the message was written.

The Flow of a Targeted Attack

Characteristics of Spear Phishing

Attackers gather information about the target from social media and websites, then craft emails impersonating a colleague or business partner. Using work-related content such as "Here are the materials from the other day's meeting" or "I am sending you the revised version of the contract," they trick the recipient into opening an attachment or link. The email address also uses a domain that closely resembles the legitimate one. Studies by security firms indicate that 91% of targeted attacks begin with a spear phishing email. From 2024 to 2025, advanced spear phishing emails that mimic the target's writing style have been increasing, making detection difficult through conventional visual inspection alone.

The Difference from Phishing and Whaling

Ordinary phishing targets large numbers of unspecified recipients, like a "mass email impersonating a bank"; although its success rate is low, mass distribution still produces victims. Spear phishing narrows its focus to a specific individual or organization and raises its success rate through customization based on prior research. Whaling is a form of spear phishing that targets executives and people with high approval authority, aiming for direct money-transfer instructions or the theft of confidential information. The precision of the attack and the amount of damage increase in the order of phishing < spear phishing < whaling.

Defensive Measures

It is important to develop the habit of not carelessly opening attachments or links in suspicious emails and of verifying with the sender through a separate channel. If you use a unique, strong password for each service and set up two-factor authentication, you can keep the damage to a minimum even if credentials are stolen. For companies, adopting email authentication technologies such as DMARC, SPF, and DKIM, along with regular phishing drills, is effective. Be sure to also practice protecting your email account.