Spear phishing: Why targeted attacks are becoming more dangerous
Have you been hearing more about spear phishing lately? There is a good reason why the term is appearing in so many cybersecurity reports right now: AI is making targeted deception attempts faster, more convincing, and possible on a larger scale.
Phishing, the attempt to trick people into taking an action that compromises security using forged or manipulated messages, has affected companies for decades. With spear phishing, however, the deception is specifically tailored to an individual, a role, or a company. It only takes a handful of details to appear credible in the rush of everyday work: The colleague’s name is correct, the project actually exists, and the service provider is familiar? At that point, an e-mail may contain enough familiar details for the trap to work. Familiarity makes such messages harder for employees to recognize.
This development highlights a fundamental point: security measures must evolve along with attack methods. While the psychological mechanism behind spear phishing is not new, the amount of available context – and with it the ability to quickly create credible, precisely targeted messages – is growing rapidly.
Spear phishing relies on context
With spear phishing, what matters is how well the message matches the recipient – unlike conventional phishing, which usually relies on volume and reach. Attackers use names, responsibilities, projects, business partners, or current events and combine this information with familiar methods of social engineering – such as time pressure, authority, or an apparently routine request. Typical characteristics include:
Personalization: Spear phishing messages are specifically tailored to an individual, role, or organization.
Trust: Names, projects, colleagues, or familiar service providers make the message credible.
Social Engineering: Attackers use time pressure, authority, routine, or a willingness to help to trigger a response.
The information needed is easier to find than you might think. Company websites, LinkedIn profiles, press releases, and job postings reveal a great deal about teams, roles, and the systems in use. Information from previous data leaks can be even more valuable: names, roles, contact information, or project details help an attacker make a new message more convincing. Accordingly, spear phishing can pursue very different objectives:
Credentials: A common goal is to steal usernames, passwords, or other authentication data.
Malware: Links, files, or commands can be used to execute malware on a system.
Data and payments: Attacks may target confidential information, payment approvals, or other sensitive actions.
Information: Compromised internal information can serve as a starting point for further attacks, for example more convincing social engineering, targeted follow-up communication, or the preparation of new phishing campaigns.
How AI is changing the threat landscape
Artificial intelligence (AI) makes it easier to prepare and scale such attacks. Publicly available information – even from very different sources – can be combined more quickly, texts can be adapted to different roles and languages, and many variations can be generated. Mandiant, a Google-owned cybersecurity company, also reports in its M-Trends 2026 Report on the use of large language models (LLMs) for hyper-personalized social engineering.
For day-to-day security awareness, this has one simple consequence: grammatical errors, unusual forms of address, or awkward translations are becoming less reliable as warning signs. A message can be well written, refer to a real business process, and still come from an attacker.
Training and awareness – two of the most important protective measures – must adapt to this changed reality. Employees should carefully review unusual requests, unexpected time pressure, and login prompts. Particularly sensitive processes, such as changes to bank details, payment approvals, or the disclosure of confidential information, should always be confirmed through an additional, independent communication channel.
Phishing is often just the beginning
Credentials obtained through spear phishing or a compromised user account can become the basis for further attacks. In cybersecurity, this is referred to as the “Initial Intrusion Vector,” meaning the original entry point into a system or network.
When deception succeeds, access protection matters
The risk of a phishing attack can be reduced, but never completely eliminated: even experienced employees can make the wrong decision when confronted with a convincing phishing message. Companies must therefore be aware of the potential consequences and have appropriate emergency plans and measures in place.
These include, among others:
Passkeys/FIDO2: Phishing-resistant login methods make it more difficult to misuse stolen credentials.
Two- or multi-factor authentication (2FA/MFA): An additional authentication factor ensures that a password alone is not enough to gain access.
Zero Trust and Least Privilege: Users receive only the permissions and data access they actually need for their tasks.
Access control: Granular permissions and restricted downloads limit potential follow-on damage.
Monitoring and activity logs: Suspicious logins, downloads, or permission changes can be identified and traced more quickly – which is particularly important in the event of a successful attack.
What this means for a virtual data room
In a virtual data room (VDR), transaction documents, contracts, financial data, intellectual property, or confidential project documents are often shared with internal and external participants. Access should therefore be controlled just as precisely. netfiles supports, among other things, two-factor authentication, passkeys and FIDO hardware, SSO, granular permissions, and detailed activity logs. Administrators can define who can see which information and which actions are permitted.
Spear phishing demonstrates why these features are important when used together: carefully configured permission management limits access to data - and therefore also limits what an attacker can see and do with a compromised account.