EC-Council Certified Ethical Hacker (CEH) v12Social EngineeringMedium
A cybercriminal group is planning a highly targeted attack against a senior financial executive of a major corporation. They spend months collecting personal information about the executive, including their family members, hobbies, recent travel, and professional relationships, through open-source intelligence (OSINT) and social media reconnaissance. Their goal is to craft a highly believable and emotionally manipulative email to trick the executive into approving a fraudulent wire transfer. Which specific type of social engineering attack are they preparing?
- ASmishing
- BWhaling
- CBaiting
- DVishing
Show answer & explanationAnswer & explanation
Correct answer: B. Whaling
The scenario describes a highly targeted phishing attack specifically aimed at a high-level executive, leveraging extensive personal information to increase believability and manipulate the target. This specific form of spear phishing is known as whaling.
Why the other options are wrong
- A. Smishing is phishing conducted via SMS (text messages), not email.
- C. Baiting involves offering something enticing to lure the victim, which is not the primary mechanism described here (it's about manipulation through trust and urgency).
- D. Vishing is phishing conducted over the phone, not via email as described.
Whaling
A highly targeted form of spear phishing attack that specifically targets senior executives, CEOs, or other high-profile individuals within an organization.
- Aims for high-value targets with significant authority.
- Often involves extensive reconnaissance to create a convincing lure.
- Typically seeks large financial gains or access to critical information.
Memory trick: Whales are big targets in the ocean of emails.