Flamingo Raises $4.5M Seed Round · Led by Vertex Ventures, bringing total funding to $6.7M to build the open, AI-native layer for IT and security.
What spear phishing is, how it differs from bulk phishing, whaling and BEC, how attackers research targets and why AI makes it cheap, two documented cases, red flags to teach users, the controls that stop it and a first-hour playbook.
The email names a supplier your client pays monthly, quotes last month's order number and asks for Friday's payment to go to a new account. Every detail in it came from LinkedIn, the client's website and a supplier's press release. That's spear phishing, and this guide covers how it's built, how to spot it and the controls that stop it.
Phishing is a message that pretends to come from someone you trust. The goal is to get you to click, type a password, open a file or send money. Spear phishing is the same trick aimed at one person or a small group, with details picked for them. The meaning is in the name: a net catches whatever swims past, a spear goes after one fish.
In cyber security, the term covers any channel. Email is the classic one. The same researched pitch also arrives as a text from "the CEO," a LinkedIn message, a Teams chat or a phone call. Verizon's 2026 Data Breach Investigations Report says attackers are leaning on voice and other mobile-centric tricks to catch people mid-workday.
The details make it work. The message uses the target's name and role, mentions a real colleague or supplier, and lands when the request makes sense: invoice week, payroll day, the CFO's conference trip. It may come from a spoofed address, a look-alike domain or a real account the attacker already took over.
What the attacker wants is usually one of four things. A password, through a fake sign-in page, which is the credential harvesting route. A payment, through a changed bank account or an urgent wire. A foothold, through an attachment that runs code. Or data, such as payroll records or a customer list.
These four terms get used as synonyms. They describe different things: how wide the attack is, who it aims at and what it's after.
| Attack | Who it targets | How personal it is | What it usually wants |
|---|---|---|---|
| Bulk phishing | Thousands of inboxes at once | Generic: "your parcel is on hold" | Passwords, card numbers, malware installs |
| Spear phishing | One person or a small team | Researched: names, roles, suppliers, timing | Passwords, payments, a foothold, data |
| Whaling | Executives and the people around them | Heavily researched, often about deals or legal matters | Wire transfers, sensitive data, executive mailboxes |
| Business email compromise (BEC) | Finance, payroll, anyone who moves money | Sent from a spoofed, look-alike or hijacked real account | The payment itself |
Whaling is spear phishing with a bigger fish. BEC is the money end of the same family. The FBI defines it as a scam aimed at businesses that work with suppliers or regularly send wire transfers. It runs on compromised email and other channels, through social engineering or intrusion.
The two often chain together. One spear phishing email steals a mailbox password, and the attacker then sends invoices from the real account to real customers. BEC is also where the losses pile up: the FBI's 2025 Internet Crime Report counted 24,768 BEC complaints and $3.05 billion in reported losses in 2025, second only to investment fraud.
Every spear phishing attack starts with homework, and the homework is mostly public. Security people call it OSINT, open-source intelligence: information anyone can read without breaking in.
LinkedIn gives the org chart. It shows who works in accounts payable, who they report to and who joined last month. A new hire's "excited to start" post tells an attacker who is new, keen to help and still learning what a normal request looks like.
The company website adds names, titles and the email format, usually first.last@. Press releases and case studies name suppliers and partners, which is how an attacker learns whose invoices look routine. Conference agendas and social posts supply the timing: the week the CFO speaks in another city is the week a rushed "approve this before I land" email sounds plausible.
Then come the technical checks. A DNS lookup shows whether the company's domain enforces DMARC. If it doesn't, the attacker can send mail as the exact domain. If it does, they register a look-alike, such as "rn" standing in for "m". Old breach dumps add passwords staff may have reused.
The output is short: one target, one trusted name to impersonate, one believable request and a date to send it. Nothing in it needed a break-in.
Research and writing used to be the expensive part. A convincing lure took time for each target, so attackers saved the effort for big ones. Generative AI cuts that cost, so a 20-person firm's bookkeeper can get the personal treatment too.
Threat groups are doing this in the open. Google's Threat Intelligence Group reported in January 2025 that the Iranian group APT42 used Gemini to research individual policy and defense experts. It also used it to write material for phishing campaigns. Google's read was measured: the tools help attackers "move faster and at higher volume," not invent new tricks.
The results show up in click rates. Microsoft's Digital Defense Report 2025 put the click-through rate of AI-automated phishing emails at 54%, against 12% for standard attempts. The FBI's 2025 report adds that chat tools can quickly write official-sounding emails that mimic a CEO. Voice cloning can be used to request wire payments too.
One old habit has to go. "Look for spelling mistakes" made sense when lures were rushed and templated. Language models don't make typos. The tells that survive sit in the request, not the writing.
IBM's Jeff Crume walks through a test that pitted human-written phishing against AI-written phishing, and covers what still protects you:
That leaves the awareness deck from a few years back with a problem. Its checklist was written for a different kind of email.
Two documented cases show the pattern better than any made-up scenario. Both ran on impersonation and a routine payment process.
From 2013 to 2015, a Lithuanian man named Evaldas Rimasauskas ran a scheme against two US tech companies. He registered a company in Latvia with the same name as an Asian computer hardware maker both companies paid for real goods. Then he opened bank accounts in that name in Latvia and Cyprus.
Emails built to look like they came from the hardware maker's staff told the victims' employees to pay what they owed into the new accounts. Forged invoices, contracts and letters, some bearing fake corporate stamps, went to the banks to explain the size of the transfers. The companies wired over $100 million, according to the US Attorney's Office for the Southern District of New York.
Fortune named the victims as Google and Facebook in April 2017, and both companies confirmed it to CNBC, saying the funds were largely recovered. Google said the fraud targeted its vendor management team. Rimasauskas pleaded guilty to wire fraud in March 2019. In December 2019 he was sentenced to five years in prison and ordered to forfeit $49.7 million. By then, prosecutors put the total at over $120 million.
On June 5, 2015, Ubiquiti Networks found it had been defrauded. It told the SEC in a Form 8-K filed on August 6, 2015. The filing describes "employee impersonation and fraudulent requests from an outside entity targeting the Company's finance department." Those requests moved $46.7 million from a Hong Kong subsidiary to overseas accounts held by third parties.
By the time it filed, Ubiquiti had recovered $8.1 million. It booked a $39.1 million loss for the quarter, per its Q4 2015 earnings release. Its audit committee found no evidence that company systems were penetrated or that employees took part. It also concluded that internal control over financial reporting was ineffective, due to one or more material weaknesses. In plain words, the payment process itself was the gap.
The common thread is simple. An instruction arrived by email, it looked like it came from someone the company already dealt with, and money moved on the strength of it. That's the step to design controls around.
Users don't need a course on email headers. They need a short list of tells that still hold when the writing is perfect:
One rule covers all six: confirm the request on a channel the sender doesn't control. That means a phone number from your own records, a message to the person's known account, or a walk to their desk.
No single control stops every version. The useful question is which step of the attack each one breaks.
An r/msp thread comparing email filters lands on the same point: strong on bulk phishing, weaker on targeted mail.
SPF lists the servers allowed to send mail for your domain. DKIM signs each message. DMARC tells receiving servers what to do with mail that claims your domain but fails those checks. At p=reject, receivers that check DMARC refuse mail faking your exact domain. That shuts down the cheapest version of the CEO email.
It doesn't stop look-alike domains, and it only protects domains that publish it. Check your top suppliers' records too, since a spoofable supplier domain is a ready-made invoice scam. Our DMARC guide walks through the rollout from p=none to p=reject.
A visible External tag makes the "CEO" writing from a Gmail address stand out. In Exchange Online it's one command: Set-ExternalInOutlook -Enabled $true.
Microsoft's anti-phishing policies add a first contact safety tip for senders a user has never heard from. Defender for Office 365 adds impersonation protection for named people, up to 350 users per policy, plus your own and partner domains.
A password plus a texted code still falls to a fake sign-in page that relays both in real time. FIDO2 security keys and passkeys don't. The credential is tied to the real site's domain, so a look-alike page gets nothing it can use. CISA's MFA guidance calls phishing-resistant MFA the gold standard and FIDO/WebAuthn the only widely available form of it.
Start with the people spear phishing aims at first: admins, finance and executives. Know the limits too. A passkey doesn't help when the lure asks for a payment instead of a login. It also doesn't stop device code phishing, where the victim signs in on the real Microsoft page.
This is the control aimed at the step both cases above turned on. Any new bank details, new payee or urgent wire gets a call to the requester on a number you already had. Never use one from the email. The FBI's BEC advisory says the same: use secondary channels to verify requests to change account information.
Write it into the finance procedure and set a dollar threshold for a second approver. Tell suppliers you do it, so nobody takes the call personally. It costs one phone call.
Least privilege caps the damage when someone does fall for it. Keep admin rights on separate accounts that don't read email. Limit who can change vendor bank details in the finance system. Require two people for payments over a set amount, so one phished clerk can't move money alone.
In an r/msp thread on evasive spear phishing and QR-code lures, the top answer takes this approach: assume some mail gets through, and limit what a stolen session can do.
Training pays off when it teaches the tells above and makes reporting effortless: one Report button, a quick thank-you and no blame for a click. The person reading the email is part of the control set. Verizon's 2026 DBIR found a human element in 62% of breaches, up from 60% a year earlier.
Simulations help when they mirror real lures, such as supplier invoices and fake CEO requests. Our guide to security awareness training covers what moves click rates and what only moves completion reports.
Someone will click eventually. A plan decides whether that's a five-minute fix or a wire recall.
Speed matters most at step five. In one 2025 case the FBI describes, an Oregon city government's $6 million wire was recalled. The receiving account had already been flagged.
If the lure carried an attachment, OpenFrame can search a client's devices for the file with one script and show the output in one place.
Write down what happened and when. Our incident response guide covers roles, severity levels and the notification clocks that may start running.
Spear phishing works because it's built from true details: a real supplier, a real colleague, a real deadline. The defenses that hold don't depend on spotting bad writing. DMARC keeps your domain out of the attacker's hands, phishing-resistant MFA makes stolen logins useless, and a call to a known number stops the payment.
Start with the call-back rule this week. It costs a phone call, and it targets the exact step the two cases above turned on. Then read our DMARC guide and close the domain gaps that make spoofing cheap.
Content Marketing Lead
Ohayo! I run content, SEO, social, and community at Flamingo. Before IT, I worked as a correspondent for Ukraine's Public Broadcasting Company and have a Master's in journalism.
Still deciding?
Ask Mingo answers from our docs and customer stories.
Still deciding?
Ask Mingo answers from our docs and customer stories.
