Why targeted phishing works

Spear phishing is written for one person or a small group. Attackers scrape LinkedIn, filings, press, and prior breaches so the message can name a real project, a real thread, or a real supplier. Bulk phishing fails the “is this real?” test. Spear phishing often passes it because most of it is real.

The ask is usually money, credentials, or a look-alike login. Deepfake voice or video is now a common follow-up, timed to the same thread.

A treasurer receives mail from the CFO quoting a real dividend thread, now with a new IBAN. The display name is right. The domain is one letter off. A call that looks like the CFO follows. The halt is an out-of-band check on a number already on file — not a reply, and not the number in the lure.