Targeted phishing is a social-engineering message crafted for a specific person, team, or organization. Unlike mass spam, it uses details such as job role, business partners, file names, or recent events to look believable and increase the chance that the recipient will click, reply, or open a malicious attachment.
It matters because the attack often starts before any malware runs: one convincing email or chat message can lead to credential theft, document theft, or the installation of spyware. In real operations, targeted phishing is often paired with file masquerading, fake login pages, or malicious shortcuts that look like normal documents. Defenders reduce risk with user awareness training, strong email filtering, domain and sender validation, multi-factor authentication, and careful review of unexpected attachments, links, and permission prompts. The key warning sign is relevance that feels too precise or too urgent.