Spear phishing is targeted phishing aimed at a specific person or group, often employees of a particular organization. It uses deceptive messages to exploit human behavior rather than software vulnerabilities. section 11.2.2
Distinguish spear phishing from related social-engineering attacks:
- Phishing broadly uses deceptive email to induce link clicks, malware downloads, or disclosure of sensitive information. section 11.2.2
- Whaling targets high-profile individuals, while smishing uses SMS and vishing uses phone calls. section 11.2.2
- Awareness programs and formal user training help people recognize and respond to social-engineering threats. section 11.6
