Spear Phishing

What is phishing?

Phishing attacks are some of the most common types of social engineering attacks.

Phishing involves the manipulation of emails or text messages with a large group of victims, with the intent to lure them into sharing some sort of data or information, or into opening malware-infected attachments.

Another type of phishing attacks are called ‘vishing,’ which are the same style of attack, but that occur over the phone.

What is spear phishing?

Spear phishing is — you guessed it — a type of phishing attack, but one that is more tailored to its victim, making it also more difficult to spot and protect against.

Instead of a randomized victim pool, the culprit will purposefully identify and target their specific victims — oftentimes employees within the same company — and will tailor their email with details intended to add credibility and lower suspicion.

What do phishing emails look like?

There is no specific email template that all phishing emails abide to, otherwise they would be really easy to spot.

However, spear phishing emails often look like they’re being sent from someone who works at the company you work at, so you wouldn’t doubt their credibility.

If not the company you’re employed at, then a company you know and trust, and one that it wouldn’t be odd getting an email from. Spear phishing emails often look like they’re from your bank, social media platform, online payment app, or other websites that a large fraction of the population uses.

What is an example of spear phishing?

An example of a spear phishing email can be an email intended to look like it was sent from your company’s IT team or colleague, asking you to perform an action, like resetting a password, scanning a QR code, or clicking on a link.

The spear phishing email will oftentimes be sent from an email that could pass off as being legitimate if you don’t keep an eye out. The email address could use a zero instead of an o, have a minor spelling mistake, or end in .co instead of .com.

In the example below, you can see that the email came from “[email protected]”, an email that could seem legitimate. It also states that “a colleague” wants to share a document, without listing the colleague’s name — a hint that something is suspicious.

The email also has a reminder to not share any sensitive information, which could be common for the types of senders hackers try to imitate. However, it states “outside the organization” instead of listing the company name.

The spear phishers signed the email off as “The Security Team” instead of a colleague’s name or the name of the company, another potential hint that it’s not actually an email from a colleague.

What are the differences between spear phishing vs. phishing?

Simply put, spear phishing is a specific type of phishing attack.

Phishing refers to a broad type of attack that usually involves sending bulk generic emails to a very large number of unsuspecting contacts, with the hopes that even a small fraction of them will click on the malicious link or download the harmful attachment.

Meanwhile, spear phishing is tailored to much more specific targets than generic phishing attacks. Spear phishing uses some kind of information that differentiates specific individuals from the general population — like where the person works — to look more convincing and official.

In other words, all spear phishing attacks are also phishing attacks, but not all phishing attacks are also spear phishing attacks.

What are the different types of phishing?

There are several types of phishing attacks, with some of the most common being spear phishing, whaling, vishing, and smishing.

• Spear Phishing
• Whaling: this type of attack is similar to spear phishing, but instead of concentrating on the “small fry” people, like most of the employees, whaling attacks target the “big fish” like CEO, COO, or other executives.
• Vishing: unlike the other attacks on this list, vishing attacks are verbal as opposed to written. Vishing involves making calls or leaving voice messages pretending to be the person’s bank or credit card company, intended to manipulate the victim into handing over confidential information or sensitive date, like their bank account number or social security number.
• Smishing: is also known as SMS phishing. As such, it is a type of phishing attack where perpetrators unsuspecting victims on text messaging platforms, including SMS or apps like Viber or Whatsapp.

Who is the target of spear phishing?

The thing about the increase in cyber attacks, is that nearly anyone can be a target of such attacks, and spear phishing is no different.

That being said, spear phishing is typically aimed at the average person, like an employee of a company but not its C-level, or anyone who has a bank account at a certain bank.

People who have personal information that is easily accessible online — like having a LinkedIn profile that shows where you work, or posting on social media where you shop — are more likely to be targeted for spear phishing attacks, since they’re easier to create personalized messages for.

How to easily protect your team and clients against phishing

Although there seem to be more and more types of hackers looking to access our sensitive data, there are also more and more ways to protect against those same hackers being successful.

Asides from teaching your clients or team to look out for tell-tale signs of fraudulent emails, there are cutting-edge and intuitive software that can help detect phishing emails that slip through traditional defenses.

Using Atera’s seamless integration with Ironscales, you can have a single dashboard that continually monitors both attachments and links for instant detection and remediation of any suspected attack.

Not only that, but Ironscales also integrates with whatever email platforms you use, including Microsoft Office 365, Google Workspace, Microsoft Teams, and more!

So, what are you waiting for? Try Atera’s trusted source software for free, the first 30 days are on us!