Phishing, Spear Phishing, and Whaling

Email remains the most common initial access vector in cyberattacks. Phishing exploits human psychology — creating urgency, authority, or fear — to trick recipients into clicking malicious links, opening infected attachments, or surrendering credentials. Unlike technical vulnerabilities that can be patched, human susceptibility to social pressure cannot be eliminated with a software update. Security+ candidates must understand the spectrum of phishing attacks, from mass campaigns targeting millions of random recipients to highly targeted messages crafted for a specific individual.

Mass phishing (or bulk phishing) sends the same malicious email to thousands or millions of addresses simultaneously, relying on the sheer volume of targets to achieve a small percentage of success. Common lures include fake banking alerts, package delivery notifications, password expiration warnings, and tax refund offers. The emails are generic — the attacker does not know the recipients personally. Despite low sophistication, mass phishing campaigns generate enormous numbers of victims globally and are responsible for the majority of credential theft incidents.

Spear phishing is a targeted form of phishing where the attacker customizes the message for a specific individual or small group. Attackers research their targets on LinkedIn, social media, company websites, and breach databases to craft convincing messages that reference real names, job titles, projects, or colleagues. A spear phishing email might appear to come from the target's manager requesting urgent wire transfer approval, or from HR with a 'benefits update' attachment. The personalization dramatically increases the success rate compared to generic phishing.

Whaling is spear phishing specifically targeting high-value individuals — CEOs, CFOs, board members, and other C-suite executives. These targets have authority to approve large financial transactions, access sensitive data, and override security policies. A successful whaling attack might trick a CFO into authorizing a multi-million dollar wire transfer to an attacker-controlled account, a scheme known as Business Email Compromise (BEC). The FBI estimated BEC losses exceeded $3 billion annually. Executives are also targeted for their access to intellectual property, M&A information, and strategic plans.

Angler phishing targets users on social media platforms — attackers create fake customer service accounts for major brands and respond to users who post complaints, luring them to fake login pages. Clone phishing duplicates a legitimate email (a recent invoice or newsletter) and replaces links or attachments with malicious versions, then re-sends it from a spoofed address claiming it is a corrected version. Clone phishing is particularly effective because the recipient recognizes the email format and sender, lowering their suspicion considerably.

Pharming redirects victims to malicious websites without requiring them to click a phishing link. This is typically achieved through DNS cache poisoning (injecting false DNS records into a resolver so the legitimate domain resolves to an attacker's server) or by modifying the victim's local hosts file. Unlike phishing, which requires the victim to take action, pharming works even if the user types the correct URL directly into their browser. DNSSEC and HTTPS certificate validation are the primary technical defenses.

One of the most critical phishing skills is analyzing URLs to identify spoofing techniques. Attackers use several methods: typosquatting (paypa1.com, g00gle.com), subdomain tricks (paypal.com.attacker.com — the real domain is attacker.com), URL shorteners that hide the true destination, and homograph attacks using Unicode characters that look like ASCII (xn--pple-43d.com uses a Cyrillic 'а' to spoof apple.com). Security professionals should always hover over links before clicking and use URL analysis tools to expand shortened URLs safely.

Training users to recognize phishing requires teaching specific red flags. Examine: the sender address (does the display name match the actual email domain?), email headers (does the Return-Path or Reply-To differ from the From address?), the urgency or threat language that pressures quick action, unsolicited attachments or unexpected password reset requests, and links that do not match the stated destination. The presence of one flag should raise suspicion; multiple flags together strongly indicate phishing. Organizations should define a clear process for reporting suspicious emails.

Many phishing campaigns direct victims to fake login pages that look identical to legitimate websites. Attackers clone the HTML/CSS of real sites and host them on lookalike domains or compromised websites. Modern evilginx2 and Modlishka tools act as reverse proxies, forwarding the victim to the real site while intercepting session tokens in real time — bypassing even MFA. Users should look for the padlock icon (HTTPS) but remember that HTTPS only confirms the connection is encrypted, not that the site is legitimate. Certificate Transparency logs expose phishing sites using look-alike domains.

Malicious attachments deliver malware directly to the victim's endpoint. Common formats include macro-enabled Office documents (.docm, .xlsm) that run VBA scripts when the user enables macros, PDF files with embedded JavaScript or links, ISO/IMG disk images (used to bypass Windows' Mark of the Web protections), and compressed archives (.zip, .rar) containing executables renamed with misleading extensions. Organizations should disable Office macros by default through Group Policy and configure email gateways to block high-risk file types.

Protecting executives from whaling attacks requires a combination of technical and process controls. Technically: enforce DMARC to reject spoofed emails claiming to come from the organization's domain, configure the email gateway to add banners to external emails, and enroll executives in phishing-resistant MFA (FIDO2). Process-wise: establish out-of-band verification procedures (call the requestor directly using a known phone number) before approving wire transfers or sharing sensitive data, no matter how urgent the email sounds. Train executives specifically on whaling scenarios since generic security awareness training often does not reach the C-suite.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: mass phishing relies on volume to catch a small percentage of random recipients, spear phishing is targeted and personalized using OSINT research to craft convincing messages for specific individuals, and whaling targets executives with authority over finances and sensitive data — defended with DMARC, phishing-resistant MFA, and out-of-band verification procedures. Next up we explore voice and SMS-based attacks through vishing, smishing, and pretexting.