Spear Phishing vs. Phishing, Whaling, and Cloning

Spear phishing emails are personalized to make them more believable. A spear phishing example might look something like this: An attacker knows that you use a particular type of software, such as Microsoft 365, so they send an email that looks like a notification that you need to update your password. The link you click on in the email goes to a page that looks a lot like your 365 login screen, but it is actually a fake url under the control of the attacker. By prompting you to enter your username and current password, the attacker has just gained access to your 365 account and can gather sensitive information or sabotage your company.

This attack wouldn’t work as well if it was sent to someone who doesn’t use Microsoft 365, but the specificity is what makes it dangerous. It is believable because it is exactly the kind of email that employees receive every day.

Spear Phishing And Whaling

Depending on how influential the individual is, this targeting could be considered whaling. Whale phishing, much like spear phishing is a targeted phishing attack. Whale phishing is aimed at wealthy, powerful, or influential individuals. Much like spear-phishing, successful attacks are usually aimed at a specific individual rather than an indiscriminate attack that is usually associated with a regular phishing attempt. Whaling attacks are becoming increasingly common due to the “whale” generally having complete access to the sensitive or desired information. Cybercriminals often target the boss – or the whale — rather than someone lower down in the chain of command because the whale can access information and resources that no other employee can reach.

Clone Phishing or Cloning

While spear phishing and whaling are harmful, clone phishing is a bit of a game changer. Clone phishing is a little different than a typical phishing attempt. A clone phishing attack uses a legitimate or previously sent email that contains attachments or links. The clone is a near copy to the original where the attachments or links are replaced with malware or a virus. The email is typically spoofed to appear like it is being sent by the original sender and will claim it is a simple re-send. What’s worse, the email is sent out to a large number of recipients and the attacker just waits for the victims who click it. When a victim succumbs to the cloned email, the attacker forwards the same forged email to the contacts from the victim’s inbox. This type of attack is considered the most harmful because it is hard for victims to suspect a spoofed email.

Vishing and Smishing

Vishing (voice phishing), involves using a phone to trick victims into handing over sensitive information, rather than an email. In a vishing attack, the threat actors call their target and use social engineering tactics to manipulate them into providing credential or financial information. Tactics often involve, like a lot of phishing attacks, a deadline or time limit to create a sense of urgency or impersonating someone with authority in order to make the user feel like they have no choice but to hand over information. Smishing is a closely related phishing attack that also uses phone numbers. But instead of voice mail, smishing uses text messages to trick users. These messages could contain a phone number for a targeted user to call or a link to an attacker-controlled website hosting malware or a phishing page. Victims tend to trust text messages more than a suspicious email. But, it’s more challenging to identify a vishing attack than a phishing and smishing attack.

Preventing Phishing Attacks of All Kinds

When comparing spear-phishing vs. phishing, speed phishing or anything else, prevention should be your business priority. Running a successful spear-phishing prevention campaign can improve your business’s chances of preventing a successful attack.