Whaling is a highly targeted phishing attack directed at senior executives and high-value individuals within an organization. Unlike broad phishing campaigns, whaling attacks are meticulously researched and personalized to the target's role, responsibilities, and communication patterns. The goal is typically to authorize fraudulent wire transfers, disclose sensitive corporate data, or provide credentials that grant access to critical systems.
The attacker conducts extensive reconnaissance on the target executive through public filings, press releases, social media, and corporate websites. They craft a convincing email or communication that appears to come from a trusted source such as a board member, legal counsel, business partner, or regulatory body. The message is tailored to the executive's specific context, referencing real deals, projects, or compliance matters. Common pretexts include urgent wire transfer requests, confidential acquisition documents requiring signature, or legal subpoenas requiring immediate response. The attacker registers look-alike domains and may compromise a legitimate business email account to increase credibility. Because executives often operate with less restrictive security controls and more authority to approve transactions, a successful whaling attack can result in immediate financial loss.
Whaling attacks have caused losses exceeding hundreds of millions of dollars globally. The 2016 FACC AG attack resulted in a 42 million euro loss from a single fraudulent wire transfer approved by a CEO. Organizations must implement dual-authorization for financial transactions, deploy email authentication protocols like DMARC, provide targeted security training for executives, establish verbal verification procedures for sensitive requests, and ensure executives are not exempt from security controls.