Traditional bulk phishing emails target large audiences with generic messages – often rife with typos and simplistic formatting. In contrast, spear phishing involves highly personalised messages including specific details about the target, making them appear more credible.

Spear phishing targets specific individuals or small groups with emails that mimic the style and content of legitimate communications from trusted entities. Attackers are increasingly adopting spear phishing methods and technologies in their bulk campaigns – often without technical errors.

Mass phishing campaigns cast a wide net, sending generalised messages to large lists of email addresses lacking personalisation – often with mistakes and poorly designed.

In late 2023, Kaspersky researchers observed a statistical anomaly indicating a blend of spear and mass phishing tactics, detecting emails that were too aggressive for spear phishing but too sophisticated for mass phishing. In one instance, an HR phishing email addressed the recipient by name and referenced their company yet the linked phishing form was a generic fake Outlook sign-in, a typical sign of mass phishing.

Another campaign employed “ghost spoofing” where a real corporate email address appeared in the sender’s name without modifying the actual domain. This technique, usually reserved for targeted attacks, was used in mass phishing, adding an air of authenticity but leading to a generic phishing form upon clicking the link.

Between March and May 2024, Kaspersky detected a significant increase in hybrid phishing emails. This rise indicates that attackers are leveraging advanced technologies to reduce the cost and effort of personalising mass attacks. AI-powered tools can now create convincing email content, fix typos and enhance design, making these mixed attacks more effective and harder to detect.

“Attackers are increasingly adopting spear phishing methods and technologies in their bulk campaigns, leading to more personalised emails and an expanding range of spoofing technologies and tactics. Despite being mass email campaigns, these attacks present a significant threat. To combat this evolving threat, it is crucial to implement safeguards that keep pace with technological advances and employ a combination of methods and services,” said Roman Dedenok at Kaspersky.