Spear phishing

The attacks called ‘spear phishing’ or ‘whaling’ use trickery and trust to convince users to click a link, which installs malicious code on their computer.  The attack used to steal the personal information of a specific target such as a senior government executive of a military officer.

After installing the malicious code, the attacker is able to collect valuable personal and professional data from the victim and at times allows them complete control of the affected computer.

This type of phishing has appeared as the damage caused by preexisting phishing attacks increased. The defining characteristic of spear phishing is that the attack is targeted on specific purpose.

Spear phishing poses a serious threat to corporations owing to the possibility of access to trade secrets and other classified information. Phisers constantly check the returns on various emails and modify their attacks, making it hard to create a set of rules that can be automatically applied to spot all spear phishing emails.

What all spear phishing attacks have in common is that they use some form of information about the potential victim in order to maximize the chances that he or she finds the ruse believable.

If a phisher collects personal information about a potential victim and tailors the attack to this information, then this constitutes a spear phishing attack.
Spear phishing

What is phishing?

Phishing has been one of the fastest-growing types of online crime in recent years. Spam has evolved to a new and dangerous form known as ‘phishing’.

Phishing differs from spam in that it is generated by a criminal intent on stealing personal data for financial gain. Phishing is a form of social engineering that consists of deceiving potential victims into revealing their personal or their company’s confidential information such as social security and financial account numbers, account passwords and other identity or security information.

The term 'social engineering' broadly refers to the act of manipulating people into unwittingly behaving in certain ways. Modern phishers are becoming increasingly sophisticated. Some phishing messages can be personalized, using the target’s actual name.

URLs can be disguised so that discrepancies do not appear. When in doubt the safest thing to do is always to access the institution by typing (not copying), it’s name directly in the web browser rather than clicking on a link in e-mail.

Phishing remains a significant problem despite affecting a relatively small fraction of total internet users. The growing number of internet users coupled with the ease and low cost of carrying out phishing attacks have exposed virtually every e-mail user to phishing attacks.
What is phishing?