What is Whaling Attack?

Whaling is spear phishing with a specific target class. The name comes from the size of the catch: executives can approve payments, read board material and override process, so one convinced executive is worth more than thousands of clicks in a bulk campaign.

What changes is the research and the tone. Attackers study earnings calls, press releases, conference schedules and the executive's assistant on LinkedIn, then write a message that fits a real situation: a confidential acquisition, a legal matter, an auditor's request, a payment that must clear before quarter end.

The term covers two directions.

• Classic whaling targets the executive directly, often to harvest mailbox credentials.
• The more expensive variant impersonates the executive toward someone below them, usually in finance, and that is where whaling meets business email compromise.

MITRE ATT&CK describes the pattern under Social Engineering: Impersonation (T1684.001): adversaries pose as an executive, colleague or vendor, use urgent payment language, and pick people whose job roles let them carry out the goal. The FBI's IC3 counted about 55 billion US dollars in exposed business email compromise losses worldwide between October 2013 and December 2023, which explains why the pattern keeps paying.

Whaling messages rarely carry malware, so the controls that work are procedural and identity-based.

• Payment changes and urgent transfers get confirmed out of band through a known phone number, never one supplied in the email.
• Executive accounts get phishing-resistant MFA and closer monitoring of sign-ins and mailbox rules.
• Lookalike domains of the company and its key vendors get watched, because a message from a domain one letter off the real one survives most technical filters.