Whaling
What is Whaling?
WhalingA spear-phishing attack aimed at senior executives or other high-value targets, typically seeking large fraudulent payments or access to strategic information.
Whaling is a subtype of spear phishing that targets the "big fish" of an organization — CEOs, CFOs, board members, general counsel, or other senior decision-makers. Messages are crafted to look like legitimate executive correspondence: legal notices, M&A documents, regulatory subpoenas, or peer-to-peer requests from another executive. Because of the victim's authority, a successful whaling attack often yields large wire transfers, tax records, or sensitive corporate data. Effective controls include phishing-resistant MFA, strict payment-approval workflows, executive-specific awareness training, and out-of-band verification for any unusual financial or legal request.
● Examples
- 01
An email purporting to be from a law firm sending a CEO a "confidential subpoena" that installs malware.
- 02
A fake board-chair message asking the CFO to authorize a same-day acquisition payment.
● Frequently asked questions
What is Whaling?
A spear-phishing attack aimed at senior executives or other high-value targets, typically seeking large fraudulent payments or access to strategic information. It belongs to the Attacks & Threats category of cybersecurity.
What does Whaling mean?
A spear-phishing attack aimed at senior executives or other high-value targets, typically seeking large fraudulent payments or access to strategic information.
How do you defend against Whaling?
Defences for Whaling typically combine technical controls and operational practices, as detailed in the full definition above.