Clone phishing copies a real email the target has already received, swaps its links or attachments for malicious ones and resends it as an update.
Clone phishing is a type of phishing in which the attacker takes a legitimate email the target has received before, makes a near-identical copy and replaces the link or attachment with a malicious one. Because the content, layout and context are familiar, the message feels routine and is easier to trust than a generic lure.
How it works
The attacker first needs a real message to copy. It may come from a compromised mailbox, a mass marketing email anyone can receive, or a standard notification such as a delivery update or invoice. The copy is then resent with small changes:
- the link points to a lookalike site instead of the real one;
- the attachment is replaced with a malicious file or a link to one;
- the subject adds words like "resent", "corrected" or "updated link" to explain why it is arriving again;
- the sender address is spoofed or uses a similar domain.
When the copy is sent from a genuinely compromised account, it can even land inside an existing thread, which makes it particularly convincing.
Example
As an illustration, customers of a retailer receive the usual monthly statement email. A day later, a second, identical-looking email arrives with the subject "Corrected statement". Its button leads to examplestore-account[.]com, which asks customers to sign in to view the corrected document. The email itself was copied from the real one, down to the footer.
How to spot it
- A second copy of a message you already received, with a reason for the resend.
- Links whose real destination differs from the brand's usual domain.
- Attachments that are now archives, HTML files or links to a file-sharing page.
- A sender address or reply-to address that differs slightly from the original.
- Failed SPF, DKIM or DMARC checks in the message headers.
What brands can do
Publish a DMARC policy at enforcement, backed by SPF and DKIM, so direct spoofing of your domain is rejected. Keep transactional emails consistent and tell customers you will not send "corrected" copies with new login links. When a cloned campaign appears, take down the landing pages and report the sending infrastructure. Phishvoid handles the site takedown side of this; get in touch if your emails are being copied.
Read more: How to Spot a Phishing Email: 12 Signs and Examples
Seeing this against your brand?
We find and take down phishing and impersonation sites. Tell us what you are seeing.