Knowledge / identity acsc-glossary

Whaling

Spear phishing aimed at senior executives. The invoice looks like their job. The bank details do not.

PHISHING / identity abuse, not a malware class01Lure02Landing03Capture04ReuseControls: phishing-resistant MFA, reporting, mail auth, drills.

Whaling is highly targeted spear phishing against people with authority and access: CEOs, CFOs, system owners. The bait is usually a payment, a share sale, or a legal panic.

Out-of-band verification for money movement, dual control, and executive assistants trained to treat urgency as a warning sign. MFA on the exec mailbox is not optional decoration.

Fact source: ASD's ACSC glossary.