Spear phishing typically involves extensive research on the target. The attacker might gather information from social media profiles, public records, or other online resources. This data is then used to craft a convincing email that appears to come from a trusted source, such as a colleague, boss, or reputable company. The email often contains a malicious link or attachment, which, when clicked, can lead to serious security breaches, such as stealing sensitive information or installing malware.