Spear phishing vs phishing is really a question of who the email was meant for. Ordinary phishing gets sprayed at a long list of addresses in the hope that somebody bites. A spear phishing email is aimed at you in particular, or at a handful of people, and it’s built from whatever the sender dug up about you beforehand.
Underneath, both want the same things from you. Click the link, log in, open the attachment. The difference is all that homework, and it’s exactly why the targeted kind is so hard to catch.
| Phishing | Spear phishing | |
|---|---|---|
| Who it’s for | Anyone on a list | One named person or a small group |
| Research first? | Little or none | Yes: role, colleagues, projects, interests |
| What the message looks like | Generic: a locked account, a parcel, an invoice | Specific: a real project, a recruiter, a document you’d expect |
| Volume | Thousands of copies | A handful, sometimes just one |
| A case from this library | Target (2013): an email to a small contractor, about 40 million card accounts exposed | Axie Infinity (2022): a fake job offer to one engineer, about $540 million in crypto taken |
| What stops it | Filters, link checks, phishing-resistant MFA | The same, plus checking unexpected requests and documents through another channel |
Key takeaways
Bulk phishing is a numbers game. The sender doesn’t know you and doesn’t need to. If enough people get a “your account has been locked” email, a few will click. So the message has to fit almost anyone, which is why it tends to be vague.
The targeted version flips that around. Here the attacker chooses a person before writing a word, and it’s often someone picked for what they can get into rather than how important they are. Then comes the digging: their LinkedIn profile, the company site, a talk they gave at a conference, leaked data from some old breach. The email that arrives mentions a real project or a believable job offer. The things people are taught to look for, like a generic greeting or a strange request, simply aren’t there.
That’s also why it costs more to run. One message per target takes time. Attackers save it for people whose inbox is worth the effort.
Staff got an email titled “2011 Recruitment Plan” with an Excel file attached. Opening it let the attackers into the company behind the SecurID authentication product. EMC later recorded a $66.3 million charge for customer remediation. Full case: RSA SecurID breach.
A senior engineer at Sky Mavis went through what looked like a real hiring process on LinkedIn, then opened a job-offer PDF carrying spyware. The attackers, identified as North Korea’s Lazarus group, worked from that one laptop to the keys that controlled the Ronin bridge. About $540 million in crypto was taken. Full case: Ronin bridge heist.
This one sits somewhere in between. Spoofed Google security alerts went to more than 300 people, with the real link hidden behind a URL shortener. But every recipient was picked from one campaign, and the alerts looked like something they’d actually get. More than 50,000 of the campaign chairman’s emails were stolen. Full case: DNC Google alert phishing.
Target’s breach started with a malware-laced email at a small HVAC contractor, not at Target itself. The malware stole the contractor’s login to Target’s vendor systems. From there, attackers got into Target’s network and put card-stealing malware on store registers.
Target’s filings confirm about 40 million payment card accounts exposed, and its Form 10-K for fiscal 2016 put the total cost at $292 million, or $202 million after insurance. The lesson isn’t about how clever the email was. It’s about how much one supplier’s login could reach. Full case: Target vendor phishing breach.
Tip: an email that knows your boss’s name and your current project hasn’t proved anything. It might just mean someone did their reading. If it wants you to act, get in touch with the sender using contact details you had already, not the ones it gave you.
More detail on the targeted version is on the spear phishing page, and the wider collection is in the phishing cases.
Yes, it sits under the phishing umbrella, which covers any message faking a trusted sender to get a click, a login or an opened file. Spear phishing is simply the version with a named target. Aim it at a senior executive and people call it whaling; see whaling vs spear phishing.
Message for message, yes. It’s made to fool someone who’s paying attention, and it tends to land with people whose accounts are worth a lot. Bulk phishing makes up the gap with sheer numbers, and both kinds kick off some very expensive cases here.
A lot of the time the wording won’t give it away. The ask will. Open this, log in here, approve that, pay this. If you weren’t expecting it, check with the person through a channel you already trust, no matter how well the email seems to know you.
Training helps people pause. But an email written around your real job leaves very few clues to spot. So the heavy lifting falls to things that still work after someone’s been fooled, like security keys and opening attachments in isolation.
Yes. The name comes from email, but the same trick turns up in texts, LinkedIn messages and phone calls. See vishing vs phishing and smishing vs phishing.
Reviewed by SEE Team. Last reviewed 21 Oct 2026. Each case link goes to the full write-up, sources included. How pages are researched and fact-checked. About Social Engineering Examples.
Social Engineering Examples