Spear Phishing

In this article, you’ll learn what spear phishing is, how it differs from regular phishing, and why it’s a growing threat to businesses. We’ll look at how these attacks work, common techniques used and the warning signs to look out for.

What is Spear Phishing?

Spear phishing is a form of social engineering, often involving the impersonation of an individual to trick the recipient into performing a desired action, usually financial in nature. Often a hacker will pretend to be someone the victim knows, such as a colleague, manager, customer or supplier.

Unlike traditional phishing emails, spear phishing emails actually target people who would normally treat fake emails with a healthy degree of scepticism. This means that spear phishing emails are much more effective at building trust. In particular, it exploits the recipient’s good faith by making them believe they are safe – for example, because of seemingly familiar sender addresses or the reputation of the company named in the email.

With this successful deception, the cybercriminal can now take the spear phishing attack to the next level. The unsuspecting victim will only discover the ruse much later, when it is usually too late to react.

This is how a spear phishing attack works in practice

Once the victim has received a deceptive email, they may be tricked into downloading a link that installs carefully hidden malware. Alternatively, a link may take the victim to a bogus website where a form is filled in to collect personal information.

In recent years, it has become increasingly apparent that spear phishing is no longer limited to email communication. Social channels are also being used for this type of attack. Once the link or malware has been planted on the potential victim’s computer, the cybercriminal can simply sit back and wait.

Spear phishing vs phishing

Spear phishing and phishing attacks both use impersonation to commit fraud. The difference between the two is that spear-phishing emails impersonate people, while phishing emails impersonate brands. Unlike phishing, spear phishing targets a single individual, contains no links or attachments in the email, and typically contains a request for a wire transfer, gift cards, or direct deposit changes rather than account information. Below are just two examples of a phishing email versus a spear phishing email:

The Targets of Spear Phishing

Attackers usually find out about their target beforehand. First name, last name, date of birth, place of residence, street, hobbies and information about family members, friends and business associates are all easy to find on the Internet. There are countless publicly accessible databases. In most cases, it is the users themselves who ensure that their profile information is freely visible to third parties. This is particularly true of social media.

The attacker also learns information such as the preferences and habits of the target, for example by seeing what online purchases they have made at what time on eBay or Amazon. Even tracking movement patterns is no longer a major challenge for cyber criminals. With GPS, many users of so-called tracking services can even help an attacker find out exactly where a user is, when they are there and for how long.

The continuum of email spoofing used

To trick recipients into thinking they’re reading an email from a trusted sender, spear phishers use a technique called “spoofing” that allows them to impersonate a legitimate sender and email address. There are three primary methods of email spoofing : 

Spear Phishing Examples

There is no shortage of ways to trick people into giving up sensitive data and credentials. However, there are some well-honed attacks that spear phishers turn to time and again.

• Direct Deposit Changes
  
  In one version of this scam, a hacker posing as an employee sends an email to an HR assistant, requesting to change their bank account for their payroll direct deposit. In another version, a hacker posing as a vendor emails a staff member in accounting, informing them that the company’s bank account and routing number has changed, and future payments should be sent to the new account.
• Gift Card Requests
  
  Posing as an executive, a hacker asks an employee to purchase multiple gift cards and send them the codes on the back of the cards. Often, a hacker will say that they’re in a meeting or away from their office. This adds to the believability of an executive writing an email from a personal email address, such as Gmail or Yahoo.
• W-2 Spear Phishing
  
  A spear phisher posing as an executive emails a staff member in the HR department, requesting employee W-2s, a US tax form reflecting employee earnings and tax deductions. Tax time is particularly stressful for accounting and HR departments, and the pressure, in addition to the time constraints, makes them vulnerable to making the mistake of falling for this type of attack.
• Multiphase Attacks
  
  A common method for hacking into Microsoft 365, multiphase attacks begin with phishing and evolve into spear phishing. A hacker sends a phishing email to an employee, impersonating Microsoft. The victim unknowingly gives up their Microsoft 365 login credentials on a phishing page. Armed with the victim’s username and password, the hacker enters the business’s Office 365 ecosystem where they launch spear phishing attacks using legitimate Microsoft 365 email addresses.
• Wire Transfer Requests
  
  Also known as business email compromise (BEC), this spear phishing variant is one of the most costly. A hacker posing as a top executive makes a request for funds in the form of a wire transfer. In many high-profile cases, businesses were completely unaware that millions of dollars had been sent to fraudulent bank accounts.

Spear Phishing Techniques to look out for

A one-off, text-only spear phishing email might look unsophisticated on the surface, but there are social engineering techniques at work that reveal a sophisticated level of psychological manipulation. Below are some examples : 

• Engaging in pretexting 
  
  Spear phishers prime their victims by first sending a friendly email and engaging in small talk, such as “how was your vacation?” or “congrats on the promotion.” This lowers the victim’s guard, prepping them for the spear phisher’s eventual request, which might not come for several more emails. 
• Making urgent requests 
  
  Often, spear phishers will convince their victims that they have only hours—or even minutes—to send a wire transfer, change their bank account information, or purchase gift cards for clients. 
• Sending emails via mobile 
  
  Spear phishers posing as executives often claim to be out of the office, even out of the country, and urgently need the victim’s help. Adding “sent from my iPad, iPhone, or Android device” adds to the believability of such a claim and also excuses mistakes in the email, such as typos. It also creates an excuse for using a non-corporate email address like Gmail. 

(Digital) Sources for Spear Phishing

Attackers often look for reviews on travel portal pages. Online hotel guest books can give a very detailed overview of a person’s financial background. In this way, specific conclusions can be drawn quickly about interrelationships among business and private areas. However, this is only a digital search for information.

In any case, employees who freely disclose personal data increase the risk of being affected by a spear phishing attack. Because those in the company who handle their data carelessly are ideal targets, spear phishers specific look for employees with such vulnerabilities.

How can companies protect themselves from a Spear Phishing attack?

Spear phishing attacks are a particular challenge for corporate IT security officers. After all, the individual employee is the central weak point. Links and file attachments are recklessly opened without recognising the real sender.

The same applies to false friend requests received via social networks. The recipient’s psyche is used as a gateway, bypassing their innate scepticism. Because it is so effective, the number of spear phishing attacks is increasing every year, so it is extremely important to educate and raise awareness of the dangers of spear phishing.

Using traditional Email Defense

Using predictive defense

With predictive defense, artificial intelligence (AI), including a combination of supervised and unsupervised machine learning models, work together to identify the telltale and difficult-to-detect signs of spear phishing :

Protect your Buisness with 365 Total Protection

Hornetsecurity for M365 blocks advanced attacks from the first email thanks to machine learning models that perform real-time behavioral analysis of the entire phishing email, including any URLs and attachments. Our AI-based threat detection stops threats before, during, and even after phishing attacks.