Spear phishing vs phishing: what is the difference?

Question

Accepted Answer

Phishing is sent in bulk to many recipients using a generic lure. Spear phishing targets one named person, using researched detail about their role, colleagues and current work. The research is the whole difference, and it is why spear phishing succeeds against people who would delete a bulk phish.Bulk phishing is a volume business. The attacker accepts a very low response rate because the send costs almost nothing, so the message has to be generic enough to plausibly reach anyone.Spear phishing inverts that. One target, one message, built from information the attacker gathered first, often from LinkedIn, company filings or a previous breach. The lure references something real, which removes the cues most people are trained to look for.Documented cases

The RSA SecurID breach of 2011 cost an estimated $66M and began with an email titled "2011 Recruitment Plan" sent to a small group of employees, one of whom opened the attachment. A bulk campaign would not have been worth the effort against that specific target set.
The Axie Infinity Ronin Bridge heist is the largest loss in this library at $540M. The entry point was a fake LinkedIn job offer aimed at a named senior engineer, with a fabricated interview process and a document that carried the payload.
Operation Aurora targeted named engineers at Google, Adobe and other technology companies with tailored messages rather than a broad send.
For contrast, the Target breach of 2013 cost $292M and started with ordinary phishing at a refrigeration vendor. The scale of the loss came from what the credentials unlocked, not from the sophistication of the lure.

The control that breaks both
Neither is stopped by teaching people to spot bad grammar.
What breaks both is removing the value of a stolen credential: phishing-resistant MFA using hardware keys, so a captured password and one-time code are not enough.
Where the request is financial, out-of-band verification to an independently sourced number is the control that holds regardless of how convincing the message was.