Study guide
16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing
Key Takeaways Explain This Topic AI
Objective 4.8 classifies the phishing family by channel and target: generic phishing, spearphishing (specific person or role), whaling (senior executives), vishing (voice), and smishing (SMS).
Credential harvesting — collecting usernames, passwords, multi-factor codes, or session material through deceit — is the typical goal of the phishing family.
Open-source intelligence emails and org charts are not authorization to phish; social-engineering tests need explicit rules of engagement for each channel.
Spearphishing is not whaling: a high-dollar pretext against an accounts-payable clerk is still spear; a whale is who, not how expensive the fraud is.
Vishing is a voice call and smishing is SMS; neither is implied by a network CIDR, and authorizing email phishing does not silently authorize calls or texts.
Last updated: August 2026
Objective 4.8 — Given a scenario, perform social engineering attacks using the appropriate tools — is the human matching drill on the same 35 percent Attacks and Exploits domain. This section is the phishing family : phishing , spearphishing , whaling , vishing , smishing , and the usual payoff credential harvesting . Dumpster diving, surveillance, shoulder surfing, tailgating, eavesdropping, watering hole, impersonation, and the named tools — Social Engineering Toolkit (SET), Gophish, Evilginx, theHarvester, Maltego, Recon-ng, and Browser Exploitation Framework (BeEF) — belong in the next section.
Social engineering is never implied by a network CIDR. The RoE must explicitly allow SE: channels (email, SMS, voice), pretext themes, whether production mail gateways may be used, how you store harvested secrets, and a stop condition when a real human is distressed or when a live credential is captured. Public open-source intelligence (OSINT) is not a license to phish. Domain 2 taught you to collect emails and org charts. 4.8 is contacting those people only if the engagement said you may.
Phishing: generic lure, wide net
Phishing is untargeted or loosely targeted deceptive messaging , classically email , that tries to make many people click or reply. The lure is generic: "Your mailbox is full," "HR updated the payroll portal," "IT will disable your account." What it does: it scales. When you pick it: the stem is a blast to a large list, a commodity template, or "employees received the same fake invoice." Credential harvesting is the typical goal: a look-alike login page that collects username and password (and sometimes multi-factor authentication codes). Other payoffs exist — a malware attachment, wire-fraud instructions — but PT0-003's listed harvest bullet is the one to name when the page is a fake single sign-on (SSO) portal.
Exam trap: calling every email spearphishing because it had a logo. A logo is not targeting. Trap two: treating a real vendor's legitimate multi-factor prompt as phishing. Trap three: running a campaign against a partner domain that is not in the SoW because "the employees might click." Partner users, customers, and personal mailboxes that only appeared in a data dump are out of scope until named.
Stay inside the authorized sending path. Many engagements require you to send through a client-approved relay or a clearly labeled tester domain so production mail security can be measured without spoofing a bank the client does not own. If the RoE forbids spoofing example.com itself, a look-alike domain is a different conversation than a blast from an unapproved third-party mailbox.
Spearphishing: one person or role, OSINT-informed
Spearphishing is phishing aimed at a specific person, team, or role , using details that would not appear in a commodity blast: a project name, a manager's real travel, a ticket number, a vendor the target actually uses. What it does: it raises credibility for a small set of victims. When you pick it: the stem shows OSINT — LinkedIn, harvested mailboxes, a press release — folded into the pretext for named staff: finance clerks, a help-desk queue, a named engineer. That is still spear, not automatically whaling . Whaling is about senior executives .
Spear still needs SE authorization. Harvesting a chief financial officer's email on objective 2.4 does not authorize sending them a fake wire request. The recon tools that built the list are not the attack; sending the lure is.
Exam trap: spear equals "email with a name in the To: line." If the body is still "Dear User" and the list is 4,000 mailboxes, that is phishing with a mail merge, not spear. Trap two: spear equals whaling. A spear at a help-desk analyst is still spear even if the pretext mentions money. Trap three: treating a highly personalized mail as authorization to skip the stop condition. A distressed target or a live production password is still a halt-and-report moment when the RoE says so.
Whaling: executives
Whaling is social engineering aimed at senior leadership — C-suite, owners, board members, or similarly high-authority targets. The channel is often email (a spear at a whale) but the classification is the target , not the font. Pretexts that show up on exams: fake legal subpoena, fake merger-and-acquisition data room, fake board portal, fake bank callback for a wire the chief executive "already approved." When you pick it: the victim is an executive, or the pretext only works because the victim is an executive. When you do not: a spear at accounts-payable staff, even if the dollar amount is large. Dollar size is impact. Whale is who .
Whaling against real executives is high-risk politically. RoE should name whether C-level is in play, who will be pre-briefed, and how you halt if the executive starts a real wire. Exam trap: "whaling is any expensive fraud." Trap two: "whaling is vishing because executives prefer phone." Channel is independent: you can whale by email, SMS, or voice. Name whaling for the executive target, then name vishing or smishing if the stem also scores the channel.
Vishing: voice
Vishing is social engineering over voice — a phone call, voicemail, or voice-over-IP pretext. What it does: it uses urgency and authority in a channel where users cannot forward a header to information technology. Classic pictures: help desk calling to "verify" a password or a multi-factor code, a fake vendor collecting a callback number, a fake bank. When you pick it: the stem is a call . Credential harvesting still applies: the caller asks for the password, the seed, the one-time code, or for the victim to read a screen.
Exam trap: vishing equals "any social engineering." A fake badge at the door is impersonation (next section). Trap two: vishing equals smishing because both are "not email." SMS is smishing. Voice is vishing. Trap three: recording production calls without RoE and without lawful-consent rules. Voice tests have extra legal overlay; if the RoE is silent on calls, do not call. Authorizing email phishing does not silently authorize vishing.
Smishing: SMS
Smishing is social engineering over Short Message Service (SMS) (and, on many stems, the same idea on multimedia messaging or consumer chat that is still a phone number). The lure is a short link or a "your package / your parking ticket / your MFA" text. When you pick it: the channel is text message . When you do not: Slack or Teams to a named engineer is closer to spear on a corporate chat, not smishing, unless the exam literally shows SMS.
Mobile users click more carelessly than on a workstation with a warning banner. The harvest page on the phone is still credential harvesting . Exam trap: smishing as "malware on the SIM." The 4.8 bullet is the message , not a baseband exploit (those sit nearer to specialized-system mobile attacks). Trap two: sending SMS to every number in a data dump that includes customers who are not in-scope employees. Trap three: treating a shipping-carrier look-alike text as automatically in scope because marketing already texts staff. The RoE must name SMS.
Credential harvesting is the typical goal
Credential harvesting is collecting usernames, passwords, multi-factor codes, or session material through deceit rather than through a 4.3 password spray or a 4.4 host dump. The phishing family is how you ask . A twin captive portal on 4.7 can harvest too; 4.8 harvest is the human path — email, SMS, or voice lure to a fake identity provider. When you pick it: the stem's success criterion is captured secrets, not a tailgate and not a browser hook (tool matching is next). Harvested secrets are live credentials: store them in the evidence channel named in the RoE, do not paste them into public chat, and stop or rotate per RoE when a real production password lands.
Multi-factor authentication does not make harvest useless. A fake login that also prompts for the one-time code still harvested a short-lived factor. Kits that steal session cookies so multi-factor is already satisfied belong with Evilginx in the next section — conceptual identification only, not a configuration how-to.
A 4.3 spray guesses passwords against a live login. A 4.4 dump pulls hashes or tickets from a host you already occupy. 4.8 harvest is the human handing you the secret because the lure was convincing. Do not mix those three on a matching item.
Differentials you must not mix
Term Channel or target Typical stem cue Not the same as
Phishing Generic email (or generic messaging) to many Same mailbox-full template to a department Spear just because a logo appeared
Spearphishing Specific person or role, OSINT-informed Named engineer, real ticket, real vendor Whaling (executive) or a 4,000-user mail merge
- Whaling Senior executive CEO, CFO, board portal, merger data room Any high-dollar accounts-payable clerk spear
- Vishing Voice call Help-desk call asking for a one-time code Smishing; door impersonation
- Smishing SMS Package-link text Email spear; specialized-system mobile jailbreak
Credential harvesting Payoff: secrets via deceit Fake SSO page, asked-for password 4.3 spray; 4.4 Mimikatz dump
Worked pretext
The SoW allows email and SMS social engineering against employees in example.com , forbids voice, and forbids touching customers. OSINT listed alex@example.com (engineer) and ceo@example.com . A generic "password expire" mail to 500 staff is phishing . A mail to Alex that cites a real ticket from OSINT is spearphishing . A mail to the chief executive about a fake board data room is whaling . A text to Alex with a shipping link is smishing . A call to the chief executive is vishing and is out of RoE here. If any of those authorized lures load a fake SSO, the goal you name is credential harvesting . Tools that run the campaign — SET, Gophish, Evilginx — wait for the next section. Sequence: classify who and which channel , then name harvest if secrets were the point, then check the RoE before anyone hits send.