Clone phishing attacks: how they work and how to stop them

Attackers constantly evolve their methods and refine the ones that work. One technique that has become increasingly common is clone phishing — and it's effective. On social engineering engagements, this style of attack often produces a high click rate.

What is clone phishing?

Clone phishing is a type of phishing attack in which an attacker copies the content of a legitimate email and weaponizes it — usually by changing a link or replacing an attachment with a malicious version.

Most people now recognize generic phishing emails: the odd fonts, the spelling errors, the too-good-to-be-true offers. Because those are easy to spot, attackers have moved to stealthier techniques. Clone phishing is one of them.

How clone phishing attacks work

Clone phishing can be sent to one target (like spear phishing) or in bulk. Either way, the mechanics are the same. First, the attacker spoofs or replicates the sender's email address, then delivers a near-perfect copy of a real message with one malicious change.

Spoofing email headers

An email has both a return address and a sender's address. When an attacker spoofs an address, they typically swap the sender's address so the message appears to come from someone else.

Visually similar domains

The other common approach is registering a look-alike domain. If your company uses company.com, an attacker might buy c0mpany.com — a zero instead of an "o." Look-alike domains often slip past spam filters.

Once the attacker can spoof and deliver a message, cloning the content is easy: copy the HTML of a real email (say, a login alert) and swap the link or attachment for a malicious one. Sophisticated attackers may also send you to a cloned website to capture your credentials.

To keep your own domain from being spoofed against others, implement SPF, DKIM, and DMARC.

The two common variants

The first variant clones an email with a link — for example a LinkedIn connection request — and edits the link so it points to a phishing site. Done well, this is unfortunately very successful.

The second variant attaches a malicious document. Say an attacker is corresponding with your sales team and receives a quote as an attachment; they can reply with a malicious document of the same name. If email security misses it and the recipient opens it, things go badly.

How to identify clone phishing

The same habits that catch any phishing catch clone phishing:

• Check the URL. Hover over links to see where they actually go. Be suspicious of shortened links (bit.ly and the like). If needed, copy the link and inspect it in a sandbox rather than clicking.
• Look for misleading domains. Look-alike domains are cheap and easy to register. If a domain looks slightly different from what you normally see, something is wrong.
• Watch your password manager. If your password manager won't auto-fill your credentials on a familiar site, investigate the URL — you may be on a phishing page.

Prevention methods

• Phishing awareness training. Teaching employees the techniques attackers use is one of the most effective defenses. Simulated phishing makes training stick.
• Email authentication protocols. SPF, DKIM, and DMARC help prevent your domain from being faked — protecting both your partners and your own employees.
• Firewall and email security. A security solution inspecting inbound email can catch malicious attachments, known bad actors, and likely phishing.
• Out-of-band verification. If a message looks off, don't reply — call the supposed sender using a number you already have. This is one of the best ways to stop targeted attacks.

Conclusion

Clone phishing is stealthy, and it's now a standard tool in the attacker's kit. Put the right email controls in place and, above all, make sure your employees are aware of the threat — awareness is one of the best mitigations for social engineering.