Spear Phishing
Unlike generic phishing, spear phishing is precisely targeted. Attackers research their victim on LinkedIn, company websites, and social media to craft a convincing, personalised message.
🎣 Phase 1 — The Bait
You are Alex Johnson, a Senior Developer at Acme Corp. You just received this email. Does it raise any suspicion?
ATTACKER'S OSINT PROFILE — Info Gathered Before Sending
Alex Johnson
Acme Corp
Senior Developer
Sarah Mitchell
Project Helios
a.johnson@acmecorp.com
Hi Alex,
This is IT Support. We're rolling out a mandatory MFA reset for all developers with access to the Project Helios staging environment as part of our Q3 security audit (approved by Sarah Mitchell).
Your reset window expires at 5:00 PM today. Failure to complete this before the deadline will lock your VPN credentials until next Monday's maintenance cycle.
Please complete the reset using your existing Active Directory credentials via the secure portal below:
If you have any questions, reply to this ticket or reach me on Teams.
— David Chen
IT Security, Acme Corp
Ext: 4421 | Teams: @david.chen-it
🔍 Phase 2 — The Reveal
This was a targeted attack. The attacker used OSINT (Open Source Intelligence) to make it feel completely real. Here's how they did it and where it broke down.
acme-corp-support.com — a lookalike domain registered by the attacker. Legitimate IT never emails from external domains. All internal comms come from @acmecorp.com.@david.chen-it and phone extension are fabricated. Always verify IT requests through the company directory — not contact details in the email itself.🛡️ Phase 3 — Defending Against Spear Phishing
- Verify any IT request through a separate, trusted channel — call the helpdesk using the number from the company directory, not the email.
- Check the sending domain carefully. IT will always send from your company's own domain (
@yourcompany.com). - Reduce your public OSINT footprint: review your LinkedIn privacy settings and limit what project details you share publicly on GitHub.
- Legitimate MFA resets are never done via clicking a link in an email — they're initiated through secure internal portals or by IT directly.
- Apply the "slow down" rule: whenever an email creates urgency, that's your signal to verify — not to comply.
- Use hardware security keys (YubiKey, etc.) for MFA — they're phishing-resistant and won't authenticate on fake domains.
- Attend regular security awareness training — spear phishing success drops significantly with educated employees.