Brandefense Academy Your trusted hub for learning, developing, and mastering the skills that shape tomorrow's digital defense.
Discover Now
RESOURCES TYPES
Brandefense Academy Your trusted hub for learning, developing, and mastering the skills that shape tomorrow's digital defense.
Discover NowJULY 23, 2026
The email looked entirely plausible. It arrived on a Tuesday morning, addressed to the CFO, referencing an acquisition the company had been discussing internally for weeks. The sender’s name matched a known legal counsel. The request, urgent and confidential, was for a wire transfer to an escrow account ahead of a signing deadline. The CFO forwarded it to accounts payable with a brief note: please process today.
None of it was real. The sender’s name was spoofed. The acquisition detail came from a leaked internal document circulating on a dark web forum. The urgency was manufactured. The confidentiality instruction was designed to prevent the one step that would have caught it: a callback to the actual sender. By the time anyone realized what had happened, the transfer had cleared.
This is whaling: spear phishing targeted specifically at senior executives and the people authorized to act on their behalf. It is not a generic email campaign. It is an intelligence-driven operation, and in 2025 and 2026, it has become more sophisticated, more personalized, and more difficult to detect than at any prior point. LLM-generated spear phishing emails now achieve a 54% click-through rate in controlled testing, compared to 12% for generic phishing. BEC attacks caused $6.3 billion in losses in 2025 alone. Multi-channel AI attacks combining deepfake, voice cloning, and email surged 680% year-over-year in 2025.
This blog maps how these attacks are built, what data attackers use to personalize them, which tools they deploy, and what a defense program that matches the actual threat looks like.
| 54% click-through rate for LLM-generated spear phishing vs 12% for generic phishing (Malwarebytes 2025) | $6.3B in BEC losses in 2025 (Verizon DBIR 2026) | 680% surge in multi-channel AI attacks combining deepfake, voice, and email in 2025 | $137K average loss per whaling incident in 2024 |
Spear phishing is a targeted social engineering attack in which an attacker researches a specific individual or organization and uses that intelligence to craft a message that appears internally credible. Unlike mass phishing, which relies on volume and accident to produce results, spear phishing relies on accuracy: the lure is tailored to the target’s role, relationships, and current context.
Whaling is spear phishing applied at the executive level. The target is a CEO, CFO, CISO, General Counsel, or board member, individuals whose authority over financial transactions, strategic data, and system access makes them worth concentrated investment. A successful whaling attack does not just compromise an account; it converts the executive’s authority into an action: a wire transfer, a credential disclosure, a system access grant, or a data release.
CEO fraud, the most widely reported variant, runs in two directions. In the first, the attacker impersonates the CEO to instruct a finance employee to execute a fraudulent transfer. In the second, the attacker targets the executive directly to capture their credentials or device access. Both directions ultimately convert the executive’s authority into attacker value, just from different positions in the chain.
| Attack Type | Who Is Targeted | Goal | Key Distinguishing Feature |
| Mass phishing | Anyone with an email address | Credential harvest or malware delivery at scale | No personalization; volume-dependent |
| Spear phishing | Specific employees, teams, or departments | Credential access, data theft, or initial access for further attack | OSINT-informed personalization targeting individuals |
| Whaling | C-suite executives and their authorized delegates | Wire fraud, credential capture, data or system access | Weeks of reconnaissance; authority exploitation |
| CEO fraud / BEC | Finance staff, HR, and executives | Unauthorized wire transfer or sensitive data disclosure | Impersonation of authority; no malware payload |
| AiTM phishing | Executives with MFA-enabled accounts | Session token theft to bypass MFA | Real-time credential and session interception via adversary-in-the-middle proxy |
The logic of executive targeting is economic. Executives represent the highest return on reconnaissance investment available in a corporate environment. Their authority compresses the attack chain: compromising a mid-level employee requires multiple steps to convert access into money or data; compromising or impersonating a CFO can convert a single message into a seven-figure wire transfer.
Executives are also unusually visible. LinkedIn profiles list their reporting structure, recent projects, and travel schedules. Press releases name them in deals. Conference programs publish their speaking slots. SEC filings detail their compensation. Earnings calls provide audio samples sufficient for voice cloning. Every public signal that builds professional credibility also builds attacker intelligence.
| The Public Footprint as Attack Surface A baseline OSINT audit of a single senior executive typically surfaces between 60 and 120 active data broker records, plus a professional profile on LinkedIn, multiple media appearances, SEC or regulatory filings, and historical email addresses from consumer data breaches. Each of these is a data point. Assembled into a targeting package, they provide enough context to craft an approach that references real projects, real colleagues, and real personal details in the same message. The executive’s public footprint is not an incidental vulnerability. It is the primary input to every step of the whaling attack chain: reconnaissance, lure construction, impersonation, and pressure tactics. Reducing that footprint through data broker removal and social media hygiene is the only defensive measure that addresses the attack before the lure is even sent. |
A well-executed whaling campaign is not spontaneous. It follows a structured preparation cycle that typically spans days to weeks before a single message is sent. Understanding that cycle is essential for building detection that can surface the attack before the lure reaches the inbox.
Target selection begins with role identification: which executive has the authority the attacker wants to convert, and which employees are authorized to act on that executive’s instructions. For financial fraud, the CFO and their accounts payable team are the primary pair. For data access, the CISO and their direct reports. For credential access, the CEO and their executive assistant.
Once the target pair is identified, profiling begins across multiple sources simultaneously. LinkedIn provides organizational structure, current projects, recent announcements, and connections that can be impersonated. The corporate website names the executive and links to press releases. Conference websites confirm upcoming travel. Data broker aggregators provide home address, phone number, and family member details. Breach databases provide historical personal email credentials that may be reused. Dark web forums may include targeting intelligence assembled by previous actors or analysts.
The lure is built to pass three tests: it should look like it came from someone the target recognizes, it should reference something the target is currently working on or expecting, and it should create a reason to act without verifying. These three requirements map directly to the intelligence gathered in Phase 1.
In the pre-AI era, lure construction required a skilled social engineer to manually research, write, and time each message. LLMs have eliminated the skill requirement. A threat actor who feeds an LLM with an executive’s LinkedIn profile, their recent public statements, a leaked internal document, and a list of current projects can generate a contextually accurate, stylistically matched phishing email in seconds. The same tool can generate 50 variants targeting different employees in the same organization.
| The AI Personalization Shift Generic phishing emails achieve a 12% click-through rate in controlled testing. LLM-generated spear phishing emails achieve 54%, matching the effectiveness of human-expert-crafted messages. This is not an incremental improvement. It is a structural change in the economics of targeted attacks: the research investment that previously made whaling expensive and slow has been replaced by a query to an AI model. In 2025, 37% of breaches involved AI-generated phishing (IBM Cost of Data Breach Report 2025). The sophistication of the lure is now determined by the quality of the intelligence fed to the AI, not by the attacker’s writing skill. An attacker with good OSINT and an LLM subscription produces a lure that security-trained executives struggle to distinguish from legitimate internal communication. |
Before the lure is sent, the attacker prepares the infrastructure that will receive the victim’s action: a spoofed email domain, a lookalike login page for credential harvest, a receiving bank account for wire fraud, or a command and control endpoint for malware delivery. Email infrastructure setup for CEO fraud typically involves registering a lookalike domain (inserting a hyphen, transposing two letters, or adding a word) and configuring it to pass DMARC/DKIM checks at basic levels.
For AiTM phishing campaigns targeting executives with MFA-enabled accounts, the infrastructure includes a reverse proxy between the victim’s browser and the legitimate login page, which intercepts both the credential and the session token after MFA is completed. The attacker does not need the password. They need the session cookie that is issued after the legitimate MFA event, which provides authenticated access to the real account.
The lure is timed to a moment when the target is most likely to act quickly: before a board meeting, during a travel window (when the executive is unreachable for verification), on a Friday afternoon (when finance teams are closing out the week), or in the immediate aftermath of a public announcement that the lure references.
The delivery channel has expanded well beyond email. In 2025 and 2026, whaling campaigns increasingly combine email with a follow-up voice call, a LinkedIn message, an SMS, or a Teams chat from an apparently legitimate contact. The multi-channel approach is not redundancy; it is psychological layering. An employee who would not act on an email alone will often act when a follow-up call confirms the urgency. Voice phishing using AI-cloned executive voices surged 442% in H2 2024. Multi-channel AI attacks increased 680% year-over-year in 2025.
| Tool Category | What It Does | How It Feeds the Attack Chain |
| LinkedIn and professional network OSINT | Extracts organizational structure, current projects, colleague names, travel schedule, and recent announcements from public profiles | Provides the contextual details that make a lure appear internally credible and the colleague names that can be impersonated |
| Data broker aggregators | Assembles home address, phone number, family member names, vehicle registration, and historical employers from public records and consumer databases | Provides personal detail for social engineering scripts, SIM swap attacks, and family-targeting pressure tactics |
| Breach and infostealer databases | Contains historical personal email credentials, password hashes, and device identifiers from consumer data breaches | Provides credentials for account takeover of personal email, which contains work documents shared informally outside the corporate system |
| Large Language Models (LLMs) | Generates contextually accurate, stylistically matched phishing emails from OSINT inputs in seconds | Eliminates the skill requirement for lure construction; enables personalization at scale across multiple targets in the same organization |
| Adversary-in-the-Middle (AiTM) phishing kits | Proxies the victim’s login session in real time, capturing both the credential and the session token after MFA completes | Bypasses MFA entirely; the attacker receives an authenticated session without needing the one-time code |
| Voice cloning platforms | Generates synthetic speech matching an executive’s voice from 20-30 seconds of recorded audio; some platforms work from three seconds | Powers vishing follow-up calls that confirm email lure instructions; used in Arup-style video conference deepfakes |
| Deepfake video generation | Creates real-time or pre-rendered video of executives that appears in video calls or is sent as video messages | Used in the highest-sophistication whaling attacks to impersonate executives in live video conferences, bypassing the visual verification that video was designed to provide |
| Lookalike domain registration | Registers domains visually similar to the target organization (typosquatting, homoglyphs, hyphen insertion) | Hosts credential-harvesting login pages and sends email that passes casual visual inspection of the sender address |
The most significant publicly documented whaling attack of the 2024 to 2026 period demonstrates how each element described above operates in combination. A finance employee received an email instructing them to participate in a confidential video conference regarding an urgent transaction. The email appeared to come from the organization’s CFO.
On the call, the CFO appeared on screen, as did several other senior executives the employee recognized. All participants verbally confirmed the urgency of the transaction and instructed the employee to authorize a series of wire transfers. The employee initially hesitated but was reassured by the visible presence of familiar faces and the consistent story across all participants.
The employee authorized 15 transfers totaling $25.6 million. Every participant on the call except the employee was an AI-generated deepfake synthesized from publicly available video and audio of the real executives. The meeting itself was the verification step the employee used to confirm the request was legitimate, and that step had been entirely fabricated.
The attack succeeded because video conferencing had functioned as the ultimate trust anchor in corporate workflows: the moment a request was confirmed face to face, doubt was resolved. The attacker understood that dynamic and targeted the trust anchor specifically.
| What Made This Attack Possible The executives had substantial public video and audio available: earnings calls, conference presentations, media interviews. Three seconds of audio is sufficient for baseline voice cloning. The deepfake quality required for a video call where participants are displayed at standard web camera resolution has been achievable with commercially available tools since 2024. The finance employee had not been trained to treat video conference appearance as a potentially fabricated signal. The verification instinct that would have caught an email lure (call back through a known number) was not triggered because the visual confirmation felt like the callback itself. A single out-of-band verification step, a direct call to the real CFO on a previously established personal number, would have stopped the attack at Step 4. That step did not exist as a required control for transactions of that size. |
| What Can an Attacker Already Find About Your Executives? Brandefense maps executive digital exposure across data brokers, breach databases, and dark web markets, before attackers use it to build a lure. Book a Demo |
Whaling attacks are specifically designed to pass through the controls that stop standard phishing. Understanding why each layer fails is a prerequisite for building a defense that actually works against this threat.
| Defense Layer | What It Catches | Why It Fails Against Whaling |
| Secure email gateway | Known malicious domains, malware attachments, flagged URLs, bulk sender patterns | Whaling email arrives from a freshly registered lookalike domain with no reputation; contains no attachment, no flagged URL, and often no link at all; BEC is pure text |
| DMARC / DKIM / SPF | Domain spoofing where the attacker uses the organization’s exact domain | Whaling typically uses a lookalike domain, not the exact organizational domain; lookalike domains pass authentication checks for themselves |
| Security awareness training | Generic phishing indicators: typos, urgency, suspicious links, unknown senders | Whaling carries no typos (AI-generated), references real context (OSINT-informed), and arrives from a sender name the recipient recognizes; generic training indicators are absent |
| Multi-factor authentication | Unauthorized login attempts using password only | AiTM phishing captures the session token after MFA completes; the attacker presents a valid authenticated session, not a login attempt |
| Email link scanning | Malicious URLs in email body and attachments | BEC and CEO fraud contain no links; the malicious element is the instruction itself, not a technical payload |
| Video call appearance | Previously functioned as ultimate trust verification | Deepfake technology makes executive appearance on a video call a fabricatable signal; the visual trust anchor is no longer reliable for transaction authorization |
An effective defense against executive-targeted spear phishing requires controls that address each phase of the attack chain: the reconnaissance phase before the lure is built, the lure construction and infrastructure phase, the delivery phase, and the authorization phase. Controls that operate only at the delivery phase will miss attacks that have already circumvented them by design.
| Capability | How It Defends Against Whaling and CEO Fraud |
| Executive personal identifier monitoring | Tracks executive names, personal email addresses, home addresses, and phone numbers across dark web markets, breach databases, and data broker aggregators, surfacing reconnaissance activity before lures are built |
| Lookalike domain detection | Identifies newly registered domains impersonating the organization’s brand or executive names, providing early warning before campaign infrastructure is activated |
| Dark web and forum surveillance | Monitors threat actor communication for targeting discussions that reference covered executives, providing pre-attack intelligence that enables proactive response |
| Credential exposure monitoring | Surfaces personal email credentials and corporate account credentials appearing in infostealer logs and breach dumps before they are used for account takeover or whaling lure context |
| Social media impersonation detection | Identifies accounts using executive names, photographs, or biographical details to impersonate covered individuals across professional and social platforms |
| Certificate transparency monitoring | Tracks new SSL certificate issuance for domains that resemble organizational or executive-related names, providing early warning of phishing infrastructure deployment |
| RELATED READING The Executive Cyber Threat: Personal Email, Home Networks, and Family Members: https://brandefense.io/blog/the-executive-cyber-threat/ : how attackers use the personal surface to reach corporate targets VIP Security Beyond the Bodyguard: https://brandefense.io/blog/executive-digital-protection/: the integrated framework for executive digital protection Account Takeover CISO Guide: https://brandefense.io/blog/cisos-guide-to-account-takeover-prevention/: the containment framework for when an executive account is successfully compromised |
Take control of your digital security with an exclusive demo of our powerful threat management platform.
