--- id: CP-002 slug: spear-phishing-osint-targeted-emails lang: en title: Spear-phishing description: Spear-phishing is an email personalised with public information about you and your company. How to spot it. canonical_url: https://startbrain.io/cyberpedia/en/articles/spear-phishing-osint-targeted-emails/ markdown_url: https://startbrain.io/cyberpedia/en/articles/spear-phishing-osint-targeted-emails.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Spear-phishing", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/spear-phishing-osint-targeted-emails/ (CC BY 4.0) wing: 1 theme: detect_phishing reflex: cr-002 schema: G1 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/spear-phishing-osint-targeted-emails/ fr: https://startbrain.io/cyberpedia/fr/articles/spear-phishing-harponnage-cible-osint/ de: https://startbrain.io/cyberpedia/de/articles/spear-phishing-gezielte-e-mails-osint/ es: https://startbrain.io/cyberpedia/es/articles/spear-phishing-correos-dirigidos-osint/ sources: - "n": 1 title: Phishing, Technique T1566 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/ accessed: "2026-11-03" - "n": 2 title: "Phishing attacks: defending your organisation" publisher: NCSC (UK) url: https://www.ncsc.gov.uk/guidance/phishing published: "2018-02-05" accessed: "2026-11-03" - "n": 3 title: Avoiding Social Engineering and Phishing Attacks | CISA publisher: CISA url: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks published: "2021-02-01" accessed: "2026-11-03" - "n": 4 title: Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1598/ accessed: "2026-11-03" - "n": 5 title: "Phishing: Spearphishing Attachment, Sub-technique T1566.001 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/001/ accessed: "2026-11-03" - "n": 6 title: "Phishing: Spearphishing Link, Sub-technique T1566.002 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/002/ accessed: "2026-11-03" - "n": 7 title: "Phishing: Spearphishing via Service, Sub-technique T1566.003 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/003/ accessed: "2026-11-03" - "n": 8 title: APT28, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127, Forest Blizzard, FROZENLAKE, GruesomeLarch, Group G0007 | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/groups/G0007/ accessed: "2026-11-03" - "n": 9 title: NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations | CISA publisher: CISA url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a published: "2023-10-05" accessed: "2026-11-03" - "n": 10 title: SVR Cyber Actors Adapt Tactics for Initial Cloud Access | CISA publisher: CISA url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-057a published: "2024-02-26" accessed: "2026-11-03" --- # Spear-phishing Spear-phishing is a booby-trapped email sent to a specific person, company or sector, not sent to millions of inboxes at random [1][2]. The attacker uses what they know about you or your company to make the message more persuasive and more realistic [2]. Such a message can mention your job, a real supplier or a colleague. It therefore does not look like the mass emails people are taught to spot. ## In 30 seconds - Where it happens: in the work mailbox, but also through social networks [1][2]. - What the attacker wants: most often to get malicious code run on your computer [1], or to obtain a password, data or a payment [2]. - The reflex: for any unusual request (payment, password, file), confirm it through a channel other than email, for example a phone call or an in-person conversation [2]. - If it is already done: tell the relevant people in the organisation straight away, even after a click. An employee who fears blame reports more slowly [2]. ## Straight answers ### What sets spear-phishing apart from ordinary phishing? Targeting. MITRE describes spear-phishing as a variant in which a specific individual, company or sector is aimed at, as opposed to untargeted malicious spam campaigns [1]. The UK's NCSC specifies that the attacker uses information about employees or the company [2]. ### How does the attacker know me? They read what is public. According to the NCSC, they exploit the information freely available on the company's website and on social networks (the "digital footprint") to make their messages more convincing [2]. The NCSC adds that partners, contractors and suppliers can also reveal information about an organisation online [2]. ### Why is it harder to spot? The usual signs of phishing are a generic greeting such as "Dear Valued Customer", a signature without contact details, spelling mistakes or an inconsistent layout [3]. A message written for you can avoid all of that. The NCSC writes that spotting every phishing email is difficult and that spear-phishing attacks are even harder to detect [2]. ### Are executives targeted first? They are a target of their own. The NCSC calls "whaling" a form of spear-phishing that aims at a "big phish", for example a board member who has access to valuable assets [2]. It also lists among the profiles of interest the people authorised to access sensitive information, to manage funds or to administer IT systems [2]. ### What should I do if I clicked or replied? CISA advises reporting the situation to the relevant people in the organisation, including network administrators, who can watch for any unusual activity. Disclosed passwords must also be changed without delay, along with those of any other accounts if the same password was used there [3]. ## Inside the attacker's head MITRE classes this phase as reconnaissance: phishing for information seeks to get credentials or other usable data disclosed, not to run malicious code [4]. The attacker can also exchange directly by email or instant messaging, posing as a source with a reason to ask, or sending several messages that seem urgent [4]. MITRE gives examples of groups. Kimsuky sent tailored emails to collect information about its victims, including contact lists used to identify other targets [4]. ZIRCONIUM targeted staff of a presidential campaign with credential-harvesting emails [4]. Scattered Spider combined credential phishing and social engineering to capture one-time passcodes (OTP) [4]. The NCSC describes what the attacker can exploit in internal operations: if working methods are known (how payments are made, for example), the attacker can imitate them to obtain a password or an unauthorised payment [2]. ## What you see on screen The sources cited here describe several forms. With an attachment, the attacker attaches a file to the email and generally relies on the user to run it, posing as a trusted source [5]. The APT28 group sent emails containing malicious Microsoft Office and RAR attachments [8]. With a link, the attacker avoids defences that inspect attachments [6]. Links can look harmless but imitate a legitimate site using special characters (an attack known as "IDN homograph"), or hide their address by taking advantage of quirks in URL syntax [6]. A link can also request OAuth 2.0 authorisation: if the user accepts, a malicious application gets access rights to the account and can act on the user's behalf [6]. Through a third-party service, the message arrives outside the company mailbox: social networks, personal web mail. MITRE notes that these services more often have a looser security policy than a company does [7]. The attacker creates fake accounts and offers, for example, a job opening [7]. That gives them a plausible reason to ask questions about the software in use [7]. They can also gain the target's trust, then send a file to the personal mailbox the target checks on their work computer [7]. That file then bypasses restrictions of the work account [7]. Other variants: the attacker inserts themselves into an existing discussion thread ("thread hijacking") [1], or the message invites the victim to call a number where they are guided to a malicious URL, malware or a remote administration tool [1]. CISA also reports sender addresses that look like those of a known company by changing or omitting a few characters, and links whose displayed text does not match the destination on hover [3]. Neutralised illustration, with no real link: ```text From: [first name of a known colleague or supplier] Subject: [mentions a real project of your department] Body: [request to review a document; paraphrased] Link: hxxps://company-login[.]invalid/[imitated login page] ``` ## Under the hood Sender spoofing: the attacker can forge the sender's identity to fool both the recipient and automatic security tools [1]. The countermeasures cited are SPF (validity of the sender's domain), DKIM (integrity of the message) and DMARC, which lets the organisation enforce these checks [1]. The NCSC adds that DMARC stops phishers from spoofing an organisation's domain and that the organisation's legitimate emails are more likely to reach inboxes [2]. Lookalike domain: the sources mention addresses close to the original (characters changed or omitted) [3] and special characters imitating a legitimate site [6]. An address that looks right to the eye may therefore not be. Harvesting: the booby-trapped page is used to collect credentials, and the attachment or the link to install code [1][4]. In one test, an assessment team from CISA and the NSA got in by phishing an end-user account that had administrator rights and compromised a domain in less than one business day [9]. Bypassing two-factor authentication: in another test, the team knew a user's credentials, but multifactor authentication blocked its logins. It posed as IT support and obtained the code by phone [9]. Some forms of multifactor authentication are vulnerable to phishing and to "push bombing" [9]. ## Case files ### 2016: the Democratic National Committee APT28 is said to have compromised the Hillary Clinton campaign, the Democratic National Committee (DNC) and the Democratic Congressional Campaign Committee (DCCC) in 2016, in an attempt to influence the US presidential election [8]. According to MITRE, the group used credentials stolen through a spear-phishing email to log in to the DCCC network, then used that access to compromise the DNC network [8]. ### February 2024: APT29's cloud access An advisory published on 26 February 2024 by the UK's NCSC and its partners describes the methods of the APT29 group, assessed as almost certainly part of Russia's SVR [10]. The advisory does not deal with spear-phishing itself, but with the next step, once a password is already known: it describes a bypass of multifactor authentication by "MFA bombing" or "MFA fatigue", where the actor repeatedly sends requests until the victim accepts [10]. It recommends limiting session lengths and allowing only authorised devices to enrol [10]. ## Sources 1. MITRE ATT&CK, "Phishing, Technique T1566 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/ (accessed 3 November 2026) 2. NCSC (UK), "Phishing attacks: defending your organisation", 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026) 3. CISA, "Avoiding Social Engineering and Phishing Attacks | CISA", 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026) 4. MITRE ATT&CK, "Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026) 5. MITRE ATT&CK, "Phishing: Spearphishing Attachment, Sub-technique T1566.001 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/001/ (accessed 3 November 2026) 6. MITRE ATT&CK, "Phishing: Spearphishing Link, Sub-technique T1566.002 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/002/ (accessed 3 November 2026) 7. MITRE ATT&CK, "Phishing: Spearphishing via Service, Sub-technique T1566.003 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/003/ (accessed 3 November 2026) 8. MITRE ATT&CK, "APT28, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127, Forest Blizzard, FROZENLAKE, GruesomeLarch, Group G0007 | MITRE ATT&CK®". https://attack.mitre.org/groups/G0007/ (accessed 3 November 2026) 9. CISA, "NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations | CISA", 5 October 2023. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a (accessed 3 November 2026) 10. CISA, "SVR Cyber Actors Adapt Tactics for Initial Cloud Access | CISA", 26 February 2024. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-057a (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/spear-phishing-osint-targeted-emails/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.