Tapolyai - 7:04 pm on Apr 30, 2006 (gmt 0)

We have started to see "spear phishing" more and more.

One of my jobs involves a lot of high profile financial organizations.

Phishing e-mails come to these organizations by reviewing job offers and HR pages to see what special benefits they offer - for example one big bank posted their medical insurance carrier name in an online job offer.

Within a week or so employees of big bank started to receive e-mails at work from Rumania purporting to be the "medical insurnace" <sic> company - beautiful HTML forms with images from the insurance web site asking for very detailed information. Major headache both at the insurance and at the big bank.

It seems that spear phishing works even better then the vanilla phishing.