"Spear-phishing" typically works by sending fake e-mails that look like legitimate correspondence, but which link to a malicious website or file attachment.
Complicating matters is that the legitimate Evernote e-mail pushes users first to a website with the domain name "mkt5371" before taking them to Evernote itself.