What Is Spear Phishing?

Definition

Spear phishing is a targeted phishing attack that uses personalized details—your name, role, coworkers, vendors, or recent events—to trick a specific person or organization into taking unsafe actions (credential entry, wire transfers, malware installation, or approving fraudulent requests).

Simple explanation

Regular phishing is junk mail to everyone (“Your package is held”). Spear phishing is a forged note that sounds like it knows you (“Maya—finance needs you to approve this vendor AI security update before noon”). The personalization is the weapon.

Technical explanation

Spear phishing campaigns combine open-source intelligence (LinkedIn, press, GitHub, breached data) with spoofed or lookalike domains, compromised real accounts, or business email compromise (BEC) patterns. Technical tells may include SPF/DKIM/DMARC failures, mismatched Reply-To headers, homograph domains, and urgency language. Modern kits increasingly impersonate AI vendors and security teams, piggybacking on news about agents, breaches, or “containment” so the story feels timely.

Defenses are layered: email authentication (DMARC at reject), phishing-resistant MFA, out-of-band verification for money/access changes, least-privilege admin, and user triage playbooks that never require clicking the suspicious link to investigate. AI can assist analysis of pasted text; it should not browse attacker URLs in a normal user session.

Real-world example

In July 2026, phishing waves resembling AegisAI-style campaigns targeted teams discussing AI tools. One ops coordinator receives: “OpenAI Trust & Safety — contain unauthorized agent session — sign in within 30 minutes.” The domain is a lookalike, DKIM fails, and the body references recent agent-containment headlines. Using a suspicious email triage prompt, the team flags it as credential harvest, reports it, and warns staff—without visiting the link. Separately, they update vendor verification rules so real AI SaaS support never asks for passwords via email.

Why it matters

SMBs are ideal spear-phishing targets: recognizable vendors, busy founders, and new AI tools that create unfamiliar “security” workflows. Agentic AI raises stakes further—if an agent can read mail or take actions, attackers may try to phish humans who approve agents or inject instructions into content agents consume. Security is process plus culture: verify out-of-band, minimize autonomy, and train “AI triage, human verify.”