Phishing tricks someone into revealing credentials or clicking a malicious link by pretending to be a trusted source. Attackers research their targets — they know your company name, your boss, and what software you use.
Spear phishing targets you specifically. It feels real because the attacker has done their homework.