Use "who" when it is the subject of its own clause.   Use "whom" when it is in any other place in the sentence, like after a preposition or if it's a direct object.
A good way to figure out whether you should use "who" or "whom," is to replace the who/whom pronoun with he/him or she/her.  Whichever one sounds correct is very likely to be the right one, and the rules for these pronouns is the same.