A whaling attack targets high profile executives with access to highly valuable information.
A whaling attack is a type of spear-phishing attack directed at high-level executives where attackers masquerade as legitimate, known and trusted entities and encourage a victim to share highly sensitive information or to send a wire transfer to a fraudulent account.
Whaling phishing attacks may also ask a user to click on a link that leads to a spoofed website that looks identical to a legitimate site, where information can be collected, or malware can be downloaded. In a whaling attack, attackers send an email that looks and seems like a legitimate email from a trusted source, often a contact within the company or with a partner, vendor, or customer account. A whaling email will contain enough personal details or references gleaned from internet research to convince the recipient that it is legitimate. Whaling attacks may also ask a user to click on a link that leads to a spoofed website that looks identical to a legitimate site, where information can be collected, or malware can be downloaded. In a whaling attack, victims may be encouraged to share sensitive data like payroll information, tax returns or bank account numbers, or they may be asked to authorize a wire transfer to a bank account that turns out to be fraudulent. For attackers, the goal of a whaling attack is usually to steal money or data, or to get access to networks that can yield much larger ill-gotten gains.
A whaling attack is a kind of phishing scam and CEO fraud that targets high profile executives with access to highly valuable information. In a whaling attack, hackers use social engineering to trick users into divulging bank account data, employee personnel details, customer information or credit card numbers, or even to make wire transfers to someone they believe is the CEO or CFO of the company. Whale phishing is generally more difficult to detect than standard phishing attacks, as these attacks often do not use malicious URLs or weaponized attachments.
Losses from internet scams have surged recently, rising over 115% from 2020 to 2024, according to IC3 complaint statistics. The FBI reports that losses due to phishing attacks totaled more than $70 million in 2024.
To improve whaling security, organizations need advanced threat protection that specifically defends against a whaling attack.
| Human risk has overtaken technology gaps as the leading cybersecurity challenge, with 8% of employees accounting for 80% of security incidents. READ THE REPORT → |
A whaling attack is much harder to recognize than a standard phishing attack, as attackers will usually invest much more time to make email communications and websites look legitimate. Some common signs that an email may be part of a whaling attack include:
Stopping a whaling attack requires a multi-layered approach to security.
As a leading provider of cloud-based email services for security, archiving, and continuity, Mimecast offers Targeted Threat Protection with Impersonation Protect to safeguard organizations and their employees and financial assets from a whaling attack.
Impersonation Protect offers instant and complete protection from this advanced form of cyberattack, scanning and evaluating all incoming email for potential attack indicators. Mimecast examines:
Simply put, a whaling attack is a phishing attack that targets and/or impersonates C-suite-level members of an organization. Posing as leaders within an organization often lures colleagues and/or employees into leaking data or credentials that help cybercriminals infiltrate the targeted organization.
Discover how Mimecast’s single platform can protect your people, AI, and data.
When Impersonation Protect identifies a suspicious email, it may be bounced, quarantined, or tagged as suspicious, with warning notifications sent to the intended recipient.
Mimecast provides whaling and spear security with features that include:
Learn more about thwarting a whaling attack with Mimecast and about Mimecast solutions for secure file transfer and spam email protection.
An attempted or successful whaling attack should be reported immediately to a variety of people. Victims should immediately alert their employer and its IT department in order to take quick action to block other attempts or to stop attackers from doing further damage. Whaling attacks can be reported to a number of organizations dedicated to helping to prevent cybercrime such as the Federal Trade Commission (www.ftc.gov/complaint), the Cybersecurity and Infrastructure Security Agency (phishing-report@us-cert.gov), and the Anti-Phishing Working Group (apwg.org/reportphishing).
To protect against whaling attacks, high-level executives can take several proactive measures:
See how Mimecast protects your people, AI, and data in a single platform.
GlossaryThreat Intelligence
GlossaryThreat Intelligence
GlossaryThreat Intelligence
