Category hub: Social engineering and human risk

In one sentence: Spear phishing is a scam message written for one person or a small team, using real details about them so that it looks like it came from someone they trust.

What is spear phishing?

Ordinary phishing is a mass mailing. It goes to millions of inboxes and hopes a few people respond. Spear phishing is different. The attacker picks a target first and writes the message afterwards.

The NCSC describes it as a targeted campaign where the attacker uses information about your employees or company to make messages more persuasive and realistic. The aim is the same as ordinary phishing: steal a password, install malware, or get money moved.

How it works

1. The attacker researches the target. The NCSC notes that attackers use freely available material on your website and social media accounts, your “digital footprint”, to make messages more convincing.
2. They write a message that fits the target’s job. It might look like a supplier invoice, a shared document or a note from a manager.
3. They send it, often from a look-alike or spoofed address. The message usually asks for something quick: open this file, sign in to read this, pay this today.
4. If the target clicks and signs in on a fake page, the attacker now holds the password. They can read email, send messages as the victim, or move on to other systems.

Who it affects and how badly

The NCSC says staff who can access sensitive information, manage money or administer IT systems are of greater interest to an attacker.

• Sole trader to 10 staff (accountancy, legal): one stolen mailbox can mean fraudulent payment requests sent to your clients.
• 10 to 50 staff (recruitment, estate agents): a compromised finance or director account can mean diverted payments and days of disruption.
• 250 plus or regulated (fintech, insurance, councils, healthcare): a compromised account holding personal data can become a reportable breach to the ICO.

Real examples

The NCSC and international partners have published an advisory on the Russia-based actor Star Blizzard. It says the actor continues to use spear phishing against organisations and individuals in the UK and elsewhere for information gathering: NCSC advisory page. Most small firms will see lower-level versions of the same technique.

How to detect it

• Ask staff to report odd messages, including ones they have already clicked. The NCSC says users who fear reprisals will not report mistakes promptly.
• In Microsoft 365, review Entra sign-in logs for unfamiliar locations after a suspicious message, and check mailboxes for unexpected inbox rules (Get-InboxRule) and new external forwarding. The NCSC advisory notes attackers set up mail-forwarding rules to keep seeing target emails.

How to fix or prevent it

1. Turn on multi-factor authentication for every email account, starting with finance and directors.
2. Set up SPF, DKIM and DMARC on your domains so it is harder to spoof you, as the NCSC recommends.
3. Switch on spam, phishing and malware filtering for inbound email.
4. Agree a rule that payment or bank-detail changes are confirmed by phone on a known number.
5. Review what your website and social media reveal about staff roles and suppliers.
6. Run realistic simulations and make reporting easy and blame-free.

Related terms

• phishing
• whaling
• business-email-compromise
• phishing-simulation
• multi-factor-authentication
• security-awareness-training

Frequently asked questions

What is spear phishing?
It is a scam message written for one person or a small team, using real details about them so that it looks like it came from someone they trust.

How is spear phishing different from ordinary phishing?
Ordinary phishing is a mass mailing. With spear phishing the attacker picks a target first and writes the message afterwards.

How can a small business defend against it?
Turn on multi-factor authentication, set up SPF, DKIM and DMARC, filter inbound email, confirm payment changes by phone and make reporting blame-free.

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.

Service page: Phishy phishing simulation.