What Is Spear Phishing? 7 Real Attacks and How to Stop Them

Spear phishing is phishing aimed at one person, or a small group, instead of thousands. The attacker does some homework first, then writes a message that fits the target’s job, projects and expectations closely enough to get past a careful reader.

Ordinary phishing plays the odds. This plays the person. That’s why it shows up so often as the first step in the biggest intrusions in this library.

Key takeaways

This library has 7 cases where a targeted phishing message was the way in, from RSA in 2011 to North Korea’s fake job interviews in 2025.
The largest single loss in the whole library started this way: a fake LinkedIn job offer to a Sky Mavis engineer, and roughly $540 million in crypto gone from the Ronin bridge.
Job offers and recruitment are the most common hook here. RSA’s lure was titled “2011 Recruitment Plan,” and both the Axie Infinity and Contagious Interview cases used fake hiring.

How does a spear phishing attack work?

Research. Role, manager, current projects, the way the team talks. Most of it comes from public sources.
A believable reason to write. Something the target really deals with: hiring, a document to review, an account warning, an industry event.
One carefully chosen target. Often picked for what they can reach, not how senior they are.
One payload. A fake login page or a booby-trapped attachment.
Staying quiet. Once inside, the goal is usually long-term access, not a quick theft.

Spear phishing examples from this library

Loss figures keep the basis stated on each case page. Some are measured, some estimated, and several cases never disclosed a dollar figure at all.

Case	The lure	What happened
Axie Infinity / Ronin Bridge, 2022	A fake LinkedIn recruiting process and a spyware-laced job-offer PDF	About $540 million in crypto taken, over $615 million by the time it was noticed
RSA, 2011	An email titled “2011 Recruitment Plan” with a booby-trapped Excel file	A $66.3 million charge for customer remediation, per EMC’s filing
Sony Pictures, 2014	Fake Apple ID “verify your account” emails to admins	Wiper malware crippled the studio; about $41 million in costs reported
DNC and Clinton campaign, 2016	Spoofed Google security alerts with masked links, sent to 300+ people	50,000+ of the campaign chairman’s emails stolen
Operation Aurora, 2009 to 2010	Targeted links plus an unpatched Internet Explorer flaw	Google, Adobe and dozens of other firms breached; no dollar figure disclosed
Nobelium USAID emails, 2021	A hijacked Constant Contact account sending USAID look-alike emails	Roughly 3,000 to 7,000 accounts across 150 to 350 organizations targeted
Contagious Interview, 2025	Fake job-interview sites copying Coinbase, Kraken and Circle	A fake camera error got applicants to paste a “fix” that installed a backdoor

Why recruitment makes such good bait

A job offer is personal, flattering and expected to come from strangers. Nobody’s surprised when a recruiter they’ve never met sends a document to open. Three of the seven cases above lean on exactly that.

At Sky Mavis, a senior engineer went through what looked like a real hiring process on LinkedIn, then opened a job-offer PDF carrying spyware. The attackers, identified as North Korea’s Lazarus group, moved from that one laptop to the Ronin bridge’s validator keys. In 2025’s Contagious Interview campaign, the fake interview sites even picked non-technical roles on purpose, and on macOS a second fake dialog asked for the system password.

What does one of these emails look like?

Usually dull. That’s the point. Here’s what the cases above had in common:

It mentions something real: your role, a project, a tool your company uses, a recent event.
It comes from a name you’d expect, like a recruiter, a vendor, IT, or a service you use. Sony’s admins got what looked like Apple ID notices.
It asks for one small action. Open this file. Check this login. Review this document.
The link or attachment is the whole attack. The DNC emails hid their links behind Bitly so the real address didn’t show.
There’s a gentle reason to act now, not a screaming one.

How do you stop spear phishing?

Check recruiters and unexpected documents another way. The Axie loss began with a job offer nobody confirmed independently.
Open untrusted attachments somewhere isolated, so a prepared document can’t reach the real machine.
Use phishing-resistant MFA. Security keys won’t log in to a fake page, which takes the sting out of credential lures like the DNC and Sony emails.
Limit what one compromise can reach. At RSA and in Aurora, a single mailbox turned into a route to critical systems.
Train people by role. Engineers holding production keys get targeted differently from finance teams, and need different examples.
Patch the browser and document software quickly. Targeted lures often come paired with an unpatched flaw, as in Aurora.

How it compares with phishing, whaling and related techniques

Phishing is about volume. This is about precision. Whaling is the same thing aimed at a senior executive. Recruitment fraud overlaps a lot, since a fake hiring process is one of the most effective lures, and credential harvesting is often the payload. A related trick skips the inbox entirely: in the Council on Foreign Relations case, attackers rigged a website the targets trusted.

Spear phishing: common questions

What is spear phishing in simple terms?

It’s a phishing message written for you specifically. The attacker looks you up first, then sends something that matches your job or interests, so it doesn’t feel like spam. The goal is the same as any phishing: get you to click, open a file, or type in a password.

What is a real example of spear phishing?

RSA in 2011. Staff received an email titled “2011 Recruitment Plan” with a booby-trapped Excel attachment. The attackers got into the company behind the SecurID authentication product, and EMC later recorded a $66.3 million charge for customer remediation.

How is spear phishing different from phishing?

Phishing goes out to huge lists and hopes a few people bite. The targeted kind goes after one person or a small group, with a message built around them. It takes more effort per target, which is why attackers save it for people with valuable access.

Can MFA stop it?

Some kinds. Phishing-resistant MFA, like FIDO2 security keys, won’t sign in to a fake page, so it blocks lures built to steal passwords. It doesn’t help when the payload is malware in an attachment, as in RSA or Axie Infinity, which is why isolating attachments matters too.

Reviewed by SEE Team. Last reviewed 21 Oct 2026. Every case on this page links to its sourced record. See the methodology and about SEE.

Spear phishing