M09-02 · Phishing, spear phishing and whaling

CEH M09-02 | Phishing, Spear Phishing, and Whaling

Module 09: Social Engineering Route title: Phishing, Spear Phishing, Whaling Suggested reading time: 10–12 minutes.

1. The conclusion first: look at who is targeted, then what you are asked to do

In the previous lesson, we saw how social engineering exploits trust to persuade someone to open a door that should remain closed. Today we examine one common approach: phishing.

Imagine you run a café. Someone sends a message saying, “There is a problem with your business account. Sign in again here.”

It might not be a real system notification. Someone could be pretending to be platform support, hoping you will enter your password on their fake website.

Sending the same message to many businesses is a common broad phishing approach. Knowing your name, café name, and a recent event you attended, then tailoring a message to you, makes the attempt more targeted. Deliberately pursuing the senior decision-maker who can approve substantial payments introduces whaling.

The goal is not simply to memorize three terms. Ask: who is being targeted, what background makes the message believable, and what action does it try to induce?

2. How do the three terms differ?

Phishing: using apparently trustworthy communication to induce unsafe action

Think of phishing as setting convincing bait and waiting for someone to take it. In information security, a common pattern is impersonating a trusted person or organization to obtain credentials or sensitive information, or direct someone to a fake website. It is a form of digital social engineering. NIST: Phishing

“Missing delivery information,” “your account will be disabled,” and “sign in again to open this document” can all serve as pretexts. Those subjects do not themselves prove fraud. What matters is whether the communication is deceptive and whether the requested action has been verified.

Phishing is not limited to stealing passwords. Opening a malicious attachment, disclosing information, or transferring money can also be the intended outcome.

Mass distribution is common, but it is not a requirement. Phishing is the broader concept; the following two types are still phishing.

Spear phishing: tailoring the approach to a particular target

A fishing net catches whatever comes along; a spear is aimed first.

Spear phishing targets a particular person, team, or organization and uses relevant background to make the communication seem authentic. A message might mention your current project and use the name of a familiar partner.

The defining feature is a targeted audience and tailored approach—not necessarily one recipient or the use of a full name.

Whaling: pursuing senior, high-value targets

The whale represents a high-level target with substantial decision-making authority, financial authority, or access to sensitive information, such as a chief executive, chairperson, or senior manager.

Whaling can generally be understood as spear phishing specifically directed at such targets. Mentioning a large amount of money does not automatically make a message whaling. Look at the intended victim.

The Canadian Centre for Cyber Security distinguishes spear phishing directed at individuals, groups, or organizations from whaling directed at high-profile individuals or senior executives. Spotting malicious email messages

These are not three unrelated boxes: whaling is also targeted phishing and belongs to the broader phishing category. If an exam offers several of these answers, use the evidence in the question to select the most specific appropriate classification.

3. One connected example: three kinds of bait at the same learning platform

The following Northstar learning-platform scenarios are fictional. They involve no real targets and require no messages or tests to be sent.

Northstar uses cloud services to store learning materials, student information, and company documents.

Scenario A: many employees receive the same account notification

Several employees receive a generic message asking them to sign in through an unfamiliar link or lose access to their accounts. Subsequent investigation establishes that the destination is a fake login page.

This is typical phishing. It uses concern about losing account access to obtain login information.

Scenario B: a collaboration notice tailored to the project coordinator

Lin, a project coordinator, receives a message mentioning the learning-material project and its partner organization. It asks Lin to sign in to view a “revised attachment.” The partner subsequently confirms it did not send that request.

This is spear phishing: a particular target and tailored context.

Knowing the project name may make the message convincing, but that information could come from a public event, social-media post, or previous data exposure. Knowing facts does not establish identity or authorization.

Scenario C: a board-document notice designed for the chief executive

An attacker targets the chief executive and uses recent board business as the context for a fake document-access portal.

This is whaling. The defining feature is the senior executive being targeted, not simply a formal writing style.

A common exam mistake: impersonating an executive does not automatically mean whaling

If an attacker pretends to be the chief executive but actually targets an ordinary coordinator, the sender name “CEO” does not by itself justify a whaling classification.

Separate:

• Who is impersonated: the identity used to appear credible.
• Who is targeted: the recipient the attacker wants to deceive.

This distinction follows from the definitions above. If information is incomplete, identify suspected targeted phishing without forcing a more specific label.

4. Why does it work? Connecting a plausible story to a dangerous action

From a defender’s perspective, the following sequence helps organize the situation. It is a teaching aid, not an official fixed set of attack phases:

Familiar identity or context → plausible reason → requested action → a security boundary is crossed → possible harm.

Apply this to Lin’s scenario:

This reconnects to M01-02: accounts and information are assets; deceptive disclosure or impersonation is a threat; an unverified workflow may be a weakness; risk still depends on likelihood and consequences.

Receiving the message does not mean an intrusion succeeded. Every intermediate step needs its own evidence.

5. Do not rely only on spelling, logos, or a familiar tone

Misspellings, urgency, and incorrect sender domains are warning signs. Their absence does not establish safety.

Artificial intelligence (AI) can help produce fluent text and organize public background information, making phishing messages resemble genuine correspondence. Fake support accounts and impersonation on social platforms can also provide entry points; phishing is not limited to email. Canadian Centre for Cyber Security: Recognize and avoid phishing attacks

These conclusions are therefore insufficient:

• “There are no typos, so it is genuine.”
• “They know what I am working on, so it must be the real person.”
• “The picture and display name match, so the account is trustworthy.”
• “They told me to ask this support contact, so I verified it.”

The last point is particularly important: if the verification phone number, support account, or website came from the suspicious message, you may simply be asking the same attacker through another interface.

This lesson focuses on written messages. Voice, text-message attacks, and impersonation are developed in the next unit. A convincing voice or image does not eliminate the need for verification.

6. Defending yourself: stop the risky action and verify through a known channel

You do not need to refuse all email. You need appropriate checks when a request concerns authentication, information, money, or permissions.

What an individual can do immediately

• 1. Do not follow the suspicious request yet. Avoid rushing to sign in, open an attachment, disclose a verification code, or send information.
• 2. Use an already trusted entry point. For example, use the official service address you previously saved instead of a newly supplied link.
• 3. Verify through an established contact method. Use the organization’s existing directory to contact the partner and confirm the specific request, information involved, and intended scope.
• 4. Report through the organization’s process. Preserve the suspicious message for the designated IT or security contact rather than circulating it for colleagues to test.

The Canadian Centre for Cyber Security likewise recommends confirming suspicious requests through another means rather than following embedded links or attachments. Spotting malicious email messages

Organizations need more than “be careful”

For the fictional Northstar organization, possible defensive designs include:

• Deliver important information through established portals, reducing unexpected switches to unfamiliar ones.
• Require independent approval for changes to payees, payment details, or access rights.
• Provide quick, blame-free reporting so people do not hide mistakes out of fear.
• Limit account permissions so one compromised account cannot access everything.
• Retain appropriate login and information-access records to establish actual impact.

These are defensive design choices for this example, not a universal checklist. Implementation must fit the organization’s systems and authorization boundaries.

7. Evidence: receiving, clicking, and being compromised are different things

Lin says, “I think I clicked the link.” That is a lead requiring prompt attention, not a complete incident finding.

Separate three layers:

• Observation: what the message, user statement, or system record actually shows.
• Inference: what those indicators may mean.
• Verification: corroborating authorized records and considering other reasonable explanations.

For example, an unusual login may be the legitimate user on a new device; a single alert is not a complete finding. Conversely, missing records do not prove nothing happened, because logging may be incomplete.

If credentials were entered or a suspicious file was executed, do not reopen it just to investigate. Promptly tell the responsible team exactly what actions occurred and follow the established incident-response process for the account and device. Do not independently erase all traces. Evidence collection and testing must remain within legitimate authorization.

8. Four sentences to remember

• 1. Phishing: deceptive communication tries to induce unsafe action.
• 2. Spear phishing: content targets particular recipients; there may be more than one.
• 3. Whaling: targeted phishing pursues senior, high-value people; do not classify only by the impersonated identity.
• 4. Defensive principle: trust does not replace verification, and receiving a message does not prove a successful attack.

9. Quick check: how would you assess this?

An ordinary finance coordinator at fictional Northstar receives a message displaying the chief executive’s name. It correctly mentions a recent learning-material project, asks for a partner payment to be redirected to a new account, and says, “Do not call first; I am in a meeting.” So far, only receipt of the message is established; whether the coordinator acted on it is unknown.

A. If investigation confirms an attack, is the best description general phishing, spear phishing, or definitely whaling? Why?

B. Does knowing the project name prove the request is genuine? How should it be verified?

C. Can the incident already be recorded as “the company was defrauded of money”? What evidence is still missing?

Try answering in your own words rather than memorizing a definition. Reference answers support self-checking; their publication does not establish that you have answered or demonstrated understanding.

Show reference answers

Reference answers

A: Prefer spear phishing; impersonating the chief executive does not by itself make it whaling

The message targets a particular coordinator and uses project-specific background to appear credible. That supports a spear-phishing classification. It also belongs to the broader phishing category.

Whaling is identified by the senior target, not only the impersonated identity. The intended victim here is an ordinary finance coordinator, so a CEO display name alone does not establish whaling. Additional evidence could justify revisiting the classification.

B: Knowing background information is not authorization; use an established trusted channel

Project information might come from public sources, exposed data, or a misused account. Stop the payment-detail change, use the existing company directory or another previously verified contact method to confirm this particular request, and follow the established change-approval process.

Do not use a new phone number, link, or support account supplied by this message to “prove the message is genuine.” A claim that the sender is in a meeting does not justify bypassing the required procedure.

C: A financial loss is not established yet

Only receipt is confirmed. Determine whether the coordinator replied, changed account details, requested or approved payment, and what the actual payment records show. Verify the recipient and payment status. A payment request is not a completed payment, and receiving phishing is not the same as suffering the intended harm.

An appropriate initial record might say: “Suspected targeted phishing received; changes to payment details and actual payment remain unconfirmed.” If the attack is later confirmed, update that finding while continuing to verify financial impact separately.

Related learning

• M01-02: Asset, threat, vulnerability and risk
• M01-03: Authorization and rules of engagement
• M01-06: Security controls and defense in depth