Spear Phishing vs. Phishing, Whaling, and Cloning

Spear phishing is a phishing attempt that tends to be more targeted than a normal phishing attack. Spear phishing could include a targeted attack against a specific individual or company. Spear phishing is generally more dangerous than regular phishing because phishing emails are so much more believable when they are tailored to attach a specific individual. However, even spear phishing can be protected against by a comprehensive phishing awareness training.

Spear Phishing Example

Spear phishing emails are personalized to make them more believable. A spear phishing example might look something like this: An attacker knows that you use a particular type of software, such as Microsoft 365, so they send an email that looks like a notification that you need to update your password. The link you click on in the email goes to a page that looks a lot like your 365 login screen, but it is actually a fake url under the control of the attacker. By prompting you to enter your username and current password, the attacker has just gained access to your 365 account and can gather sensitive information or sabotage your company.

This attack wouldn’t work as well if it was sent to someone who doesn’t use Microsoft 365, but the specificity is what makes it dangerous. It is believable because it is exactly the kind of email that employees receive every day.

Spear Phishing And Whaling

Depending on how influential the individual is, this targeting could be considered whaling. Whale phishing, much like spear phishing is a targeted phishing attack. Whale phishing is aimed at wealthy, powerful, or influential individuals. Much like spear-phishing, successful attacks are usually aimed at a specific individual rather than an indiscriminate attack that is usually associated with a regular phishing attempt. Whaling attacks are becoming increasingly common due to the “whale” generally having complete access to the sensitive or desired information.

Clone Phishing or Cloning

While spear phishing and whaling are harmful, clone phishing is a bit of a game changer. Clone phishing is a little different than a typical phishing attempt. A clone phishing attack uses a legitimate or previously sent email that contains attachments or links. The clone is a near copy to the original where the attachments or links are replaced with malware or a virus. The email is typically spoofed to appear like it is being sent by the original sender and will claim it is a simple re-send. What’s worse, the email is sent out to a large number of recipients and the attacker just waits for the victims who click it. When a victim succumbs to the cloned email, the attacker forwards the same forged email to the contacts from the victim’s inbox. This type of attack is considered the most harmful because it is hard for victims to suspect a spoofed email.

Preventing Phishing Attacks of All Kinds

When comparing spear-phishing vs. phishing or anything else, prevention should be your business priority. Running a successful spear-phishing prevention campaign can improve your business’s chances of preventing a successful attack.