Clone phishing is an attack in which the adversary copies a legitimate email the target has already received, replaces its link or attachment (opens in new tab) with a malicious version, and resends it from a spoofed or lookalike address, usually under the pretext of a resend or an updated version.
Where standard phishing (opens in new tab) fabricates a new message, clone phishing weaponizes one the recipient has already seen and trusted.
How clone phishing works
The attacker starts by intercepting a real email in transit or extracting one from a previously compromised mailbox (opens in new tab). They reproduce its formatting, sender name, subject line, and body in near-entirety. Only the payload changes: a malicious attachment can carry the same filename (opens in new tab) as the original, and a swapped link points to attacker infrastructure.
Delivery relies on two tricks. The attacker spoofs the original sender's address or uses a lookalike domain (opens in new tab) that survives a quick glance. Pretext language then explains the duplicate as a resend or a corrected version, so the recipient has a ready reason for seeing the same email twice.
In a March 2026 campaign targeting LastPass users, attackers sent fake support email threads (opens in new tab) that mimicked an existing support ticket about changing an account's primary email address, complete with forwarded internal conversation history.
The "report suspicious activity" and "revoke device" links led to a fake login page at verify-lastpass[.]com that collected master passwords (opens in new tab). The sender addresses had nothing to do with LastPass, hidden behind a "LastPass Support" display name.
Why clone phishing is hard to stop
Familiarity does the attacker's work: the recipient recognizes the format, the sender, and the timing, which makes the technique particularly effective (opens in new tab) in long-running correspondence and invoicing threads. Because the attacker copies the content from a genuine email, the message rarely carries the spelling and grammar errors that security training teaches users to spot, and repeated exposure to familiar-looking messages (opens in new tab) raises click rates.
Email authentication has a structural gap here. DMARC at enforcement blocks exact-domain spoofing, but a clone sent from a genuinely compromised account (opens in new tab) can pass SPF, DKIM, and DMARC checks.
In an early 2026 thread-hijacking campaign (opens in new tab), a phishing link arrived inside a real executive email thread (opens in new tab) from a compromised contractor mailbox, so the sending domain was legitimate and every authentication check passed.
AI has also industrialized the cloning itself. The Darcula phishing-as-a-service platform downloads the assets (opens in new tab) of any legitimate brand's website and produces an editable phishing version, and threat actors have used GAN-based techniques (opens in new tab) to mass-generate lookalike domains that evade pattern-based detection.
Types of clone phishing attacks
The variants differ in where the trusted message comes from and what infrastructure delivers the copy.
- Spoofed-sender clones. The classic form is a copied email sent from a spoofed address (opens in new tab) or a typosquatted lookalike domain, such as character substitutions like rnicrosoft.com. These usually fail authentication checks and depend on the recipient overlooking the sender field.
- Compromised-account clones. The thread-hijacking variant sends the copy from a real mailbox the attacker controls, so authentication gives the recipient nothing to work with. Emotet operators used the same borrowed trust a different way, replying inside stolen threads with a spoofed identity ( advisory AA20-280A (opens in new tab)).
- Trusted-infrastructure clones. Attackers route the copy through a legitimate service's own servers, such as an e-signature or invoicing platform, so the message inherits that provider's authentication and bypasses DMARC, SPF, and DKIM.
- Multi-channel clones. Cloned brand lures (opens in new tab) now travel beyond email. Darcula delivers them over iMessage and RCS to bypass SMS firewalls, and attackers pair texts with AI-generated voice calls (opens in new tab) or chatbot follow-ups on WhatsApp (opens in new tab).
How to defend against clone phishing
Because individual controls cover different variants, layered defense (opens in new tab) assumes some attacks will get through.
- Enforce email authentication. Enable SPF and DKIM and set DMARC to "reject" across all corporate email infrastructure, the federal baseline (opens in new tab). This stops exact-domain spoofing; separate controls address lookalike domains (opens in new tab) and compromised accounts.
- Monitor lookalike domains and drive takedowns at registration. Because DMARC protects only the exact organizational domain, catching typosquats and lookalikes (opens in new tab) at registration closes the gap the spoofed-sender variant depends on.
- Defang links and sandbox attachments at the gateway. Defanging URLs (opens in new tab) removes direct clickability, and sandbox detonation (opens in new tab) analyzes attachments before delivery, though attackers evade it with delayed execution and user-activity checks (opens in new tab) that keep payloads dormant.
- Deploy phishing-resistant MFA. Move admins and high-risk users to phishing-resistant MFA (opens in new tab), because a phishing site can capture and replay one-time passwords (opens in new tab) as easily as a password. It is the backstop when a clone arrives from a compromised account, where authentication offers little signal.
- Watch mailbox behavior alongside message content. In the compromised-account variant, anomalous logins, after-hours rule creation, and external forwarding rules signal the attack more reliably than the message itself does.
- Use simulation as intelligence. In large-scale field trials (opens in new tab), standard awareness training (opens in new tab) left click rates flat, and punishing users (opens in new tab) who click suppresses reporting.
Run phishing simulations (opens in new tab) as intelligence about which lures work against which teams.
How Doppel helps
Doppel is the AI-native Social Engineering Defense (SED) (opens in new tab) platform that unifies Digital Risk Protection (DRP) (opens in new tab) and Human Risk Management (HRM) (opens in new tab) through the Doppel Threat Graph (opens in new tab), an AI-powered intelligence layer. It detects and dismantles the lookalike domains and spoofed infrastructure used to stage clone phishing before copied emails reach inboxes.
Brand Protection watches domains and messaging apps, while agentic AI correlates signals into campaign-level views (opens in new tab) and coordinates takedowns across registrars and hosts.
Brand AbuseBox ingests employee- and customer-reported phishing (opens in new tab), correlates each report against attacker infrastructure (opens in new tab) in the Threat Graph, and routes validated clone lures to automated takedown (opens in new tab). One-click threat-to-simulation conversion turns a detected campaign into a controlled multi-channel simulation (opens in new tab).
Dismantling the domains, phishing pages, and messaging infrastructure behind each lure forces attackers to rebuild the delivery chain, making the next campaign too costly to run. Request a demo (opens in new tab) to get started.
Frequently asked questions about clone phishing
What is clone phishing?
Clone phishing is an email attack in which the attacker copies a legitimate message the recipient has already received, swaps the original link or attachment for a malicious one, and resends it from a spoofed or lookalike address. The message typically claims to be a resend or an updated version to explain the duplicate. Because it copies a real email, the message looks familiar and lacks the errors that give ordinary phishing away.
What is clone phishing in cybersecurity?
Cybersecurity practitioners classify clone phishing by how the attacker builds the message rather than by the target's identity. The attacker preserves an authentic email's formatting, sender name, subject line, and body, and swaps only the link or attachment for a malicious equivalent. These behaviors map to the MITRE ATT&CK spearphishing link and attachment techniques T1566.001 and T1566.002. The credibility comes from the prior message, so the attacker does not have to build it. A link whose destination does not match its display text is a spoofed link (opens in new tab), and a From address that disagrees with Reply-To is an impersonation signal.
What is the difference between clone phishing and spear phishing?
Spear phishing crafts a new, personalized message based on research into a specific target, so its credibility comes from newly gathered personal details. Clone phishing copies an existing real email and replaces only the link or attachment, so its credibility comes from the prior message itself. The two are distinct subtypes, though clone phishing can also be classified as a form of spear phishing, and a cloned email aimed at a chief executive is also whaling.
What is an example of a clone phishing attack?
Attackers abused the DocuSign Envelopes API to send fake invoices (opens in new tab) impersonating Norton, PayPal, and Geek Squad. Because the messages left DocuSign's own servers, they bypassed standard email-authentication checks. Recipients saw the familiar notification format of a service they use, with a fraudulent payment request substituted for the legitimate one.