Malware
Spear phishing
Spear phishing is phishing written for one person or one team, using details the attacker found about them. It works because it looks like ordinary work.
How it is measured
No count captures it; you recognize it by fit. The message names a real project, manager, or vendor, arrives at a plausible moment, and asks for something specific like a wire change or a document review. Check header results, reply-to differences, and whether the sender's domain was registered recently.
Confirm out of band: call the person on a number you already have, not one in the mail. Internal simulations can track report rate and click rate, but they measure habits rather than a real attacker's skill.
Worked example
A bookkeeper at a 12-person roofing firm gets mail from 'Dana, the owner', Re: invoice 2291 from Hargrove Supply. The reply-to is a free webmail account, the sender domain is one hyphen off the real one, and the new bank details differ from the last three invoices.
A call to Dana's mobile takes two minutes and ends it. The attacker had read the firm's site, a vendor's public project page, and a LinkedIn post, which is why the details felt right.
How it differs
Phishing casts a wide net with generic bait, and a spam filter can often spot it. Spear phishing picks a target and is written to pass for a colleague; filters see a normal-looking short message. A watering hole reaches the same targets differently, by infecting a site they already visit.
Common errors
Verifying by replying to the same message. Assuming only executives are targets, when finance and support get picked too. Trusting a message because it names a real project. Judging by spelling. Having no rule for changing bank details.
In practice
Set a rule: changes to payment details or access are confirmed through a second channel. Reduce what attackers can research by tightening what staff and vendors publish. Use MFA so a stolen password alone is not enough.