- MITRE ATT&CK defines spear phishing as phishing targeted at a specific person, company, or industry; untargeted phishing is that of mass spam campaigns.
- ENISA (Threat Landscape 2023) defines whaling as spear phishing against people in high-level positions, such as executives or politicians.
- NIST SP 800-63B-4 (July 2025) defines phishing resistance as a property that does not depend on the vigilance of the person authenticating, and excludes codes that are entered manually, such as OTPs.
- CISA asks organizations to prioritize phishing-resistant MFA for administrators and other high-value accounts (2022) and repeats this in its December 2025 cybersecurity goals.
In May 2025, the head of a think tank in the United States received an email from a supposed foreign adviser asking for his opinion on the Korean peninsula. To respond, he had to scan a QR code. In June 2025, a strategic consulting adviser received an invitation to a conference that did not exist, and the QR led to a fake Google sign-in page.
The FBI documented those cases in its FLASH alert AC-000001-MW, dated January 8, 2026, and attributes them to Kimsuky, a North Korean actor. Each pretext was tailored to the work of the person receiving it.
The case is from the United States, and we did not find an equivalent one published by a Latin American agency. That adjustment to the recipient is what defines spear phishing, and the target does not have to be a person: for MITRE ATT&CK, the attack can target a person, a company, or an entire industry.
What makes a phishing attack "spear" is how it chooses its victim
The difference between spear phishing and phishing lies in target selection: the attacker decides beforehand whom to write to. MITRE ATT&CK says so in technique T1566: in spear phishing, the adversary targets "a specific individual, company, or industry", while untargeted phishing is that of mass malware-by-spam campaigns.
ENISA, the European Union Agency for Cybersecurity, describes it as a more sophisticated version of phishing, targeted at specific organizations or people. And it names a subtype: whaling, a spear phishing attack against users in high-level positions.
The channel is another axis. MITRE divides spear phishing by delivery method: attachment (T1566.001), link (T1566.002), third-party services instead of corporate email (T1566.003), and voice (T1566.004).
Its mobile matrix, in T1660, includes targeted phishing together with SMS smishing, which ENISA also defines by channel. From those two definitions we deduce that an SMS written for a particular person is smishing and spear phishing at the same time. The differences between phishing, smishing, and vishing are in phishing and smishing.
Personalization comes from what is already exposed
The attacker assembles the message with what the organization and its people have already exposed, on open sites, social networks, or leaks, and gathers it before writing. MITRE models that stage as reconnaissance, tactic TA0043, and its techniques describe what is sought:
- Victim identity (T1589) — employee names, email addresses, and also credentials or the configuration of multifactor authentication.
- Roles (T1591.004) — who key personnel are and what data or resources they have access to.
- Social networks (T1593.001) — business announcements and information about staff roles, locations, and interests.
In T1589 and T1591, MITRE writes that what is gathered may open up initial access opportunities, and gives phishing as an example.
Leaks are the other source: CERT.br, Brazil’s incident response center, warns in its January 2024 booklet on data leaks that after a leak, more scam attempts via messages, emails, and calls are to be expected, "from targeted phishing" to extortion.
The joint guidance from CISA, NSA, FBI, and MS-ISAC of October 2023 describes the result: attackers impersonating supervisors, trusted colleagues, or IT personnel to send targeted emails and obtain credentials.
A tailored message erases the signals people are trained to detect
A tailored message loses at least one of the signals people are taught to look for. In its 2021 guide to avoiding social engineering, CISA lists as strong phishing indicators the generic greeting, such as "Dear customer," and the lack of contact information in the signature. An email that names the recipient and the topic they work on does not have a generic greeting. CISA does not state this about spear phishing: applying its list to a personalized message is an inference made in this article.
According to the FBI alert, quishing operations like these usually end with theft and reuse of the session token, which bypasses multifactor authentication without triggering the usual failed-attempt alerts. Afterward, the attackers establish themselves in the organization and send a second spear phishing email from the compromised mailbox, making the sender a real account.
The same alert recommends confirming the origin of a QR code through another route, for example by directly contacting the person who sent it. Applying that criterion to any unusual request that arrives with the correct name is our extension.
The control that resists does not depend on the person noticing the deception
NIST defines phishing resistance without counting on the person detecting the fraud. Revision 4 of SP 800-63B, published in July 2025, states it in section 3.2.5: it is the ability of the authentication protocol to prevent secrets and valid outputs from the authenticator from reaching an impostor verifier "without relying on the vigilance of the claimant". It achieves this by cryptographically binding the response to the channel or to the verifier’s identity.
The section adds that it does not matter how the person reached the false verifier, through a search engine or by email. If that phrase is applied to spear phishing (the step is ours, not NIST’s), how convincing the message is stops carrying weight: for a resistant authenticator, a tailored email and a clumsy mass email are the same attack.
The standard explicitly excludes authenticators that require their output to be entered manually, such as OTP codes and out-of-band ones: "SHALL NOT be considered phishing-resistant", because manual entry does not bind the code to the session. Passwords are not resistant either. CISA’s 2023 joint guidance names MFA based on FIDO standards or on PKI as resistant. The detail is in the factor-by-factor comparison.
The accounts with the most access come first
CISA asks organizations to start with the accounts that are most useful to an attacker.
Its October 2022 fact sheet calls phishing-resistant MFA the gold standard and urges system administrators and other "high-value targets" to migrate. It defines them as the few accounts with additional access or privileges that every organization has, and gives examples: the system administrator, lawyers with e-discovery permissions to read staff email, and the human resources team.
The 2023 joint guidance asks organizations to prioritize administrators and privileged users. CISA’s cybersecurity performance goals, version 2.0 of December 2025, repeat this in goal 3.E: they order MFA with phishing-resistant first and SMS or voice last, and ask organizations to prioritize the accounts with the highest risk.
CISA also has mobile communications guidance (version 2.0, November 2025) for people who are targeted, and there it says that SMS MFA is not strong authentication for them.
That guidance speaks to senior government officials, military personnel, and politicians. Applying it to employees with privileged access in a company is our extension, although for those accounts the 2022 fact sheet and the 2025 goals do ask organizations to prioritize phishing-resistant MFA.
We are bringing together two sources that do not cite each other: MITRE describes that the attacker looks for who has access to what (T1591.004), and CISA asks organizations to protect those accounts first.
What VU does
Authenticate, VU’s authentication capability, supports seven factors: face, TOTP, OTP by SMS, OTP by email, magic link, password, and identity document. Which factor each account requires is decided by the organization. For the accounts with the most access, the criterion is NIST SP 800-63B-4: the standard expressly excludes OTPs and passwords, and any other factor must be checked against the definition in section 3.2.5 before being assigned.
The VU capability that provides context about the device is Protect, with recognition of the equipment from which the operation is performed based on browser and mobile signals. The decision about what to do with that signal, and operation monitoring, are resolved in another layer that VU does not provide.
The better built a spear phishing attack is, the less useful it is to ask the person to notice it, and the defense that resists is the one that does not depend on that.
schedule a conversation.
