Exploring the Cyberpsychology and Criminal Psychology of Whaling and Spear Fishing On-line Attacks

ABSTRACT: This study examines the convergence of cyberpsychology and criminal psychology in whaling attacks at XXO University, where faculty received phishing emails impersonating senior leaders to solicit sensitive information. Unlike general phishing, whaling attacks are tailored to exploit authority bias and organizational trust, targeting specific high-ranking individuals to access confidential data. The inquiry highlights how psychological manipulation underpins these attacks, using techniques that circumvent technical safeguards by leveraging human behavior and cognitive biases. With spear phishing responsible for 95% of successful network breaches and 65% of targeted attacks, these tactics underscore a critical gap in traditional cybersecurity measures that focus solely on technical defenses without addressing psychological vulnerabilities (Reed 2022; Avery 2023). The investigation further reveals the escalating costs and operational risks posed by these attacks, as companies face over 700 social engineering attempts annually, averaging $14.8 million in losses for larger organizations (Reed 2022). Whaling and spear phishing is especially potent within hierarchical structures like universities, where authority compliance is ingrained. This study underscores the need for a cybersecurity framework that integrates behavioral insights, aiming to develop organizational resilience against social engineering by addressing both cognitive and technical vulnerabilities. KEYWORDS: Whale Phishing, Spear Phishing, cyberpsychology, criminal psychology, Authority-Obedience Theory, Social Engineering, Compliance Theory, Shattered Assumption Theory (SAT)