CyberGlossary

Attacks & Threats

Whaling

Definition

A spear-phishing attack aimed at senior executives or other high-value targets, typically seeking large fraudulent payments or access to strategic information.

Whaling is a subtype of spear phishing that targets the "big fish" of an organization — CEOs, CFOs, board members, general counsel, or other senior decision-makers. Messages are crafted to look like legitimate executive correspondence: legal notices, M&A documents, regulatory subpoenas, or peer-to-peer requests from another executive. Because of the victim's authority, a successful whaling attack often yields large wire transfers, tax records, or sensitive corporate data. Effective controls include phishing-resistant MFA, strict payment-approval workflows, executive-specific awareness training, and out-of-band verification for any unusual financial or legal request.

Examples

  • An email purporting to be from a law firm sending a CEO a "confidential subpoena" that installs malware.
  • A fake board-chair message asking the CFO to authorize a same-day acquisition payment.

Related terms