Spear phishing

Spear phishing is a phishing message built for one named person. Instead of a generic lure sent to thousands, the attacker researches the target and constructs something that fits their role, their projects and their expectations closely enough to survive scrutiny.

This library records 4 cases. All of them were the opening move in a much larger intrusion.

How the attack runs

1. Reconnaissance. Role, reporting line, current projects and vocabulary are assembled from public sources.
2. A plausible pretext tied to something the target genuinely handles: recruitment, a document review, an industry event.
3. A single high-value target, often chosen for access rather than seniority.
4. One payload, either a credential page or a prepared attachment.
5. Quiet persistence once inside, because the objective is usually long-term access rather than immediate theft.

Documented cases

• RSA (2011, about $66M): a single email titled “2011 Recruitment Plan” with a booby-trapped spreadsheet compromised the company behind a widely deployed authentication product.
• Operation Aurora (2009 to 2010): targeted links plus an unpatched browser flaw breached Google, Adobe and more than twenty other technology and defence firms.
• Axie Infinity / Ronin Bridge (2022, $540M): a senior engineer was courted through a fake recruitment process and opened a spyware-laced job-offer document. The largest single loss in this library.
• The Council on Foreign Relations (2012): a variant in which the trusted website itself was rigged rather than the inbox.

How it differs from related techniques

Phishing is volume; spear phishing is precision. Recruitment fraud overlaps closely, since a fake hiring process is one of the most effective spear-phishing pretexts. Credential harvesting is often the payload.

The control that would have stopped it

• Verify recruiters and unexpected documents out of band. The Axie loss began with a job offer that was never independently confirmed.
• Open untrusted attachments in an isolated environment, so a prepared document cannot reach the endpoint.
• Reduce the value of any one compromise through segmentation and least privilege. RSA and Aurora both show a single mailbox becoming a route to critical systems.
• Give high-access staff specific training. Engineers with production keys are targeted differently from finance teams and need different examples.
• Patch the browser and document stack promptly, since precision social engineering is frequently paired with an unpatched flaw.