Spear Phishing in 2026 — How Targeted Email Attacks Actually Work

Marta is the Group Treasurer at a 2,400-person Dutch logistics firm. On a Tuesday morning at 09:12 she receives an email from her CFO's address with the subject "Re: Q2 dividend wire — corrected IBAN". The thread contains the actual exchange she had with the CFO four weeks earlier about the dividend, quoted in full. The new message asks her to redirect the €1.4M payment to a different IBAN because of an alleged audit hold on the old account. The footer carries the CFO's exact signature block, his correct mobile number, and the company VAT ID. Marta has corresponded with this exact thread before. She clicks Reply — and then notices the sender domain is loglstics.nl, not logistics.nl. One missing 'i'. Nine minutes later her phone rings; the caller ID shows the CFO; the voice sounds like the CFO. Marta hangs up, opens a new email to the CFO's verified address, and asks him directly. He has not sent anything. The attack was halted; nothing was lost. Most organisations are not this lucky.

Spear phishing is a four-stage operation. Stage one is reconnaissance: the attacker scrapes LinkedIn, company press releases, public filings, and previously breached datasets to map the target's reporting line, recent projects, and language patterns. Open-source-intelligence tools (Maltego, theHarvester, public Hunter.io data) automate the first 80% of this in hours. Stage two is infrastructure setup. The attacker registers a look-alike domain — typically a homoglyph (rn vs m), a TLD swap (.co vs .com), or a missing letter — and seeds it with valid TLS, valid SPF/DKIM/DMARC, and a warmed-up sending reputation via low-volume legitimate-looking emails for two-to-six weeks. Stage three is the lure. The attacker writes a message that names a real internal project, references a recent calendar event scraped from a leaked Office 365 mailbox, or quotes a real email thread obtained from a prior compromise. This is what separates spear phishing from bulk phishing: the lure passes the 'is this real?' test because most of it is real. Stage four is action and laundering. The target wires money, shares credentials, or clicks a link that drops a credential-harvesting kit (often Evilginx for MFA-bypassing reverse proxy). The funds move through a chain of mule accounts within 30 minutes. MITRE ATT&CK techniques: T1566.001 (Spearphishing Attachment), T1566.002 (Spearphishing Link), T1585.002 (Establish Accounts: Email), and T1656 (Impersonation).

• Sender domain looks correct at a glance but contains a homoglyph, missing letter, or wrong TLD — always inspect the full address, not the display name
• Reply-To address differs from the From address, or routes to a free webmail domain
• A previous email thread quoted in full, but the new message changes a key detail like an IBAN, contract number, or delivery address
• Pressure for unusual urgency — 'before close of business', 'while you have the auditor on the line', 'CFO needs this before his flight'
• Out-of-band confirmation channel suggested by the attacker (call this new mobile number) instead of the target's known channel
• Request to bypass a normal control — 'skip the approval workflow this once', 'just send it from your personal account'
• Voice or video follow-up that matches the email exactly — deepfake voice and live-rendered video are now routine in 2026
• Email arrives outside the sender's normal working hours or with stylistic shifts (different greeting, different sign-off)

1. Verify out-of-band before acting on any sensitive requestCall the requester on a number you already have, or walk to their desk. Never call a number provided inside the suspicious message.
2. Forward the message — with full headers — to your security or IT teamIf your mail client supports 'Report Phishing', use it. Otherwise forward as attachment so the headers survive.
3. Do not delete the original message yetYour security team needs it for response. Move it to a 'Quarantine' folder you control.
4. Inspect the sender domain character-by-characterCompare against a known-good email from the same person in your archive.
5. If you clicked a link, report it immediatelySpeed matters. A credential-harvesting kit can be drained and turned into account takeover within minutes.
6. If you acted on the request, escalate to security AND finance before anything elseWire fraud can sometimes be recalled if the receiving bank is notified within hours.
7. Warn peers in the same workflow without forwarding the lureSend a separate message describing the attack pattern — never forward the original email outside of security.

• NCSC-NL — Phishing: hoe herken je het en wat doe je eraan[primary]
• NIST SP 800-63B — Authenticator considerations including phishing resistance[primary]
• MITRE ATT&CK — T1566 Phishing[primary]
• ENISA — Threat Landscape report (annual)[primary]
• Krebs on Security — Evilginx-as-a-Service phishing kits[secondary]
• Microsoft Digital Defense Report — annual breakdown of identity attacks[secondary]

• Business Email Compromise (BEC) — How to Stop the $50bn Wire-Fraud Pattern in 2026

  10 min read

• Microsoft 365 Phishing in 2026 — AiTM, Token Theft, and the End of TOTP

  10 min read

• Deepfake Voice Phishing in 2026 — When the Voice on the Phone Is Synthetic

  8 min read