Clone Phishing
What is it and how can we defend against it.
Clone phishing is a type of phishing attack where a legitimate and previously delivered email is used as a template to create a nearly identical – but malicious – version. The attacker replaces the original links or attachments with malicious ones and sends the cloned email from an address that appears to be from the original sender.
Here's how it works:
- Original Email: The victim receives a legitimate email with a link or attachment.
- Cloning: The attacker copies the content of that email and replaces the link or attachment with a malicious version.
- Spoofing: The attacker sends the cloned email from a spoofed address that looks like the original sender’s.
- Deception: Because the email looks familiar, the victim is more likely to trust it and click the malicious link or open the attachment.
How to Defend Against Clone Phishing:
- Verify unexpected follow-up emails, especially if they contain attachments or links.
- Check the sender’s email address carefully for subtle changes.
- Hover over links to preview the URL before clicking.
- Use email security tools that detect spoofing and malicious content.
- Report suspicious emails to your IT or security team.