Definition
Whaling, also known as whale phishing, is a highly targeted form of social engineering attack that aims to defraud a company or organization. Unlike broader phishing campaigns, whaling focuses on a single high-profile individual, such as a CEO, CFO, or other senior executive, who has the authority to approve large financial transactions. Attackers impersonate trusted individuals or entities to trick the victim into divulging sensitive information or transferring funds. This type of attack is particularly dangerous because it exploits the trust and authority inherent in executive positions. For instance, a whaling attack might involve an email seemingly from a legal counsel requesting an urgent wire transfer to facilitate a confidential acquisition. It is distinct from spear phishing, which targets a broader group within an organization, whereas whaling focuses exclusively on the most powerful individuals. Whaling is a critical concept covered in cybersecurity certifications like CompTIA Security+ and CISSP.