Spear phishing

Spear phishing trades volume for precision, and the work happens before the message is sent. Reconnaissance (MITRE ATT&CK tactic Reconnaissance, including T1598 Phishing for Information) builds a target profile from LinkedIn, company websites, press releases, procurement notices, conference speaker lists, code repositories and earlier breach data: who reports to whom, which suppliers and systems are in use, what projects are running, and how internal mail looks. The delivery techniques are T1566.001 (attachment), T1566.002 (link) and T1566.003 (via a third-party service such as LinkedIn messages, Teams or Slack), and once one mailbox is compromised, T1534 Internal Spearphishing uses it to target colleagues with mail that is authentic by every technical measure. Whaling is the same technique aimed at executives or board members.

Thread hijacking is the most effective modern variant. Malware families such as Emotet and QakBot stole mailbox contents and replied inside existing conversations with a malicious attachment or link, so the lure arrived from a known sender, in a real thread, referencing a real subject. Generative AI has removed another traditional warning sign by producing fluent, context-aware text in any language, including Danish, at negligible cost, which makes per-target personalisation scalable.

Payloads have evolved with defences. When Microsoft began blocking VBA macros in Office files carrying the internet Mark-of-the-Web by default in 2022, attackers shifted to container formats (ISO, IMG, ZIP), LNK shortcuts, HTML smuggling and OneNote attachments, several of which initially did not propagate the Mark-of-the-Web to their contents. Credential-harvesting spear phishing increasingly uses adversary-in-the-middle proxies that capture session cookies and defeat OTP and push MFA. Classic cases show the pattern: the 2011 RSA breach began with an Excel file titled "2011 Recruitment plan" sent to a small group of employees, exploiting a then-unpatched Flash vulnerability, and in 2016 John Podesta's Gmail account was compromised through a fake Google security alert.

Generic awareness training is weakest here, because the message may contain none of the taught red flags. Controls that do not rely on the recipient spotting the lure carry more of the load: phishing-resistant MFA (FIDO2/WebAuthn) against credential theft, attachment sandboxing and Office attack-surface-reduction rules against payloads, impersonation protection for named VIPs and key suppliers in the mail gateway, reducing what is published about staff and internal systems, and verification procedures for unusual requests. Spear phishing differs from pretexting in being usually a single crafted message rather than a sustained role, and business email compromise is the spear-phishing subtype whose goal is a payment rather than code execution or credentials.