Whaling refers to malicious hacking that targets high-ranking executives. Similar to phishing, whaling is where the hacker hunts for data that they can use, but they focus on high-ranking bankers, executives, or others in prominent or powerful positions in an organization. Hackers will search for public information on the target to convince the victim that they are legitimate. Whalers also attack their ‘Whale’ targets by hacking into the company networks where these high-ranking executives work and then target those executive’s computers with malware such as keyloggers or remote access trojans (RAT).

A real-world example of Whaling happened in an undisclosed business where a number of executives fell for an attack laced with accurate details about them and their businesses. The attacker pretended to be from a United States District Court with a subpoena to appear before a grand jury in a civil case. The email included a link to the subpoena, and when recipients clicked the link to view it they were infected with malware instead.

What should SMB’s do about Whaling?

Protect and educate your C-Suite on the dangers of posting too much information on social media that is open to the public. The more information a hacker can research on a CEO or CFO, the easier it is to attack them with a Whaling email attack. This advice also helps prevent hackers from targeting other employees at your company with bogus emails purportedly from the C-Suite executive with novel and convince phishing schemes based upon the hacker’s research. 


In addition to adopting a patch management system, CyberHoot recommends the following best practices to protect individuals and businesses against, and limit damages from, online cyber attacks:

Watch this short video to learn more about this topic:

Share this on your social networks. Help Friends, Family, and Colleagues become more aware and secure.