ClonePhishing

Clone phishing is a form of social engineering and email-based fraud in which an attacker dupes a recipient into revealing credentials or installing malware by mimicking a legitimate, previously sent message. The attacker relies on the victim’s familiarity with the original communication to bypass skepticism and prompt trust.

In a typical clone phishing operation, the attacker copies the content of a genuine email and resends it from an address that appears legitimate or compromised. The message contains a modified link, attachment, or call to action that, if followed, leads the user to a fake login page or to malware.

Clone phishing often exploits routine business or service interactions, such as invoices, password resets, or delivery notices. It may utilize a spoofed sender name, look-alike domain, or a hijacked account to improve credibility. The goal is to harvest credentials, install malware, or gain access to restricted systems.

Defenses center on user awareness and technical controls. Users should verify unexpected requests, hover over links to inspect destinations, and contact the supposed sender through an independent channel. Organizations can deploy email authentication (SPF, DKIM, DMARC), security awareness training, multi-factor authentication, and automated threat protection to detect and quarantine clone phishing messages.

Clone phishing is related to other phishing variants such as spear phishing and business email compromise and represents a persistent risk in modern phishing threats.