Spear Phishing: When the Attacker Already Knows Who You Are
Unlike generic phishing sent broadly, spear phishing is personalized using real information about the specific target — making it significantly harder to recognize.
SPEAR PHISHING
Precision manipulation built on target reconnaissance.
Spear phishing is a targeted attack in which an adversary gathers prior intelligence on a specific individual or team, weaving real names, active project details, and genuine business relationships into a highly tailored lure.
Unlike mass untargeted phishing, spear phishing does not rely on generic broad lures. Across Nigerian commercial banks, energy joint ventures, and public sector ministries, attackers study organizational charts, regulatory filings, and social media footprints. They build convincing context so that when a payment request or contract update arrives, it feels like a legitimate continuation of normal business operations.
In local enterprise environments, spear phishing targets key decision-makers—such as treasury managers, procurement officers, and executive assistants—who possess authorization rights for financial disbursements or sensitive data transfers.
Because the email references authentic ongoing initiatives, standard technical filters often pass the message directly to the victim's inbox.
RECONNAISSANCE TRAIL
How attackers build a targeted lure.
Spear phishing succeeds because adversaries do homework before making contact. Follow the timeline below to see how public data is converted into a dangerous attack vector.
Gathering organizational intelligence
The attacker monitors professional networking sites, press releases, and public procurement boards to map out key personnel, reporting lines, and current corporate projects.
Mr A. Obi is a senior procurement officer at an energy firm working on an active facility upgrade with an external contractor, Example Engineering Services.
Exploiting operational gaps
The attacker sends routine inquiries to administrative addresses to trigger automated out-of-office replies, establishing key staff absences and alternative contact details.
The Head of Finance is out of the country on leave for two weeks, leaving Mr A. Obi as the primary approving authority for pending vendor invoices under 5 million Naira.
Crafting the tailored message
The attacker registers a lookalike domain matching the legitimate contractor and drafts a message referencing the exact contract reference number and ongoing site work.
"Dear Mr Obi, following up on the facility upgrade contract #ENG-2026-08, please find the updated banking details for our milestone payment attached. As discussed with your Finance Head prior to his trip, kindly confirm receipt."
Exploiting trust under pressure
The target sees accurate names, project codes, and internal context. Believing the request is legitimate and urgent, the employee bypasses out-of-band verification and processes the fraudulent update.
ORGANISATIONAL DEFENSE
Neutralizing targeted spear phishing attacks.
Defending against precision targeted attacks requires strict operational controls and a strong reporting habit across all departments.
Verify out-of-band and limit exposure
- Verify any payment modification or sensitive data request by calling the sender on a known, official telephone number already on file—never use numbers supplied within the email.
- Minimize detailed operational references, such as specific project codes or vendor relationship details, in public social media posts or automated out-of-office replies.
- Report suspicious tailored messages immediately using the platform Report Phishing button to alert internal security teams.
Dual-authorization & continuous assessment
- Establish mandatory multi-person approval protocols for account changes and funds disbursements, aligned with the CBN cybersecurity framework.
- Deploy realistic, highly targeted spear phishing simulations based on regional operational scenarios rather than generic global templates.
- Maintain strict digital footprint policies and conduct regular risk assessments aligned with ISO/IEC 27001 (Annex A 6.3) standards.
RELATED SECURITY TOPICS
Explore specific attack vectors and defenses.
Phishing
Broad, automated email attacks designed to harvest credentials and compromise user accounts at scale.
CEO Fraud & BEC
Executive impersonation schemes aimed at misdirecting wire transfers and bypassing financial controls.
Social Engineering
The psychological manipulation principles attackers use to exploit trust, urgency, and professional courtesy.
Frequently asked questions
How does spear phishing differ from standard phishing?
Standard phishing uses generic, broadcast-style messages sent to thousands of recipients. Spear phishing involves tailored research on a specific target, using real names, internal project details, and corporate roles to build credibility.
Why are executive assistants and procurement staff primary targets?
These roles regularly handle external communications, process invoices, and coordinate executive calendars. Threat actors target them to leverage their authorization privileges or access internal communication channels.
How can organizations prevent spear phishing via social media reconnaissance?
Organizations should establish digital footprint guidelines, educate staff on public privacy settings, and mandate out-of-band verification steps for any request involving financial transactions or credential changes.
Train your personnel to recognize targeted manipulation before it bypasses internal controls.
See how the training works →