"Spear-phishing" typically works by sending fake e-mails that look like legitimate correspondence, but which link to a malicious website or file attachment.

BBC: The White House as seen on 17 March 2010

"When (people) go shopping, they want the legitimate experience of the brand, " he told style website Business of Fashion recently.

CNN: SHARE THIS

Complicating matters is that the legitimate Evernote e-mail pushes users first to a website with the domain name "mkt5371" before taking them to Evernote itself.

CNN: 50 million compromised in Evernote hack