CyberStack

Knowledge / identity acsc-glossary

Spear phishing

Phishing with a name on it. Aimed at a person or a small group, usually with enough context to look like Tuesday.

PHISHING / identity abuse, not a malware class01Lure02Landing03Capture04ReuseControls: phishing-resistant MFA, reporting, mail auth, drills.

Spear phishing is phishing aimed at a chosen person or group rather than a spray. The lure uses role, supplier, or last week's real thread. Volume is lower. Hit rate is not.

Same controls as phishing, plus tighter scrutiny on finance and executive mail, and a culture where unusual payment requests get a second channel. Whaling is this idea aimed at the top of the org chart.

Fact source: ASD's ACSC glossary.