Clone phishing: when a real email comes back poisoned

Clone phishing is one of the sneakier variants because it weaponises something you already trust: a real email. The attacker copies a legitimate message you have seen before, swaps the link or attachment for a malicious one, and resends it under a plausible excuse. Familiarity does the rest.

How the trick works

• Copy — an attacker replicates a genuine email: the wording, logo, signature and layout.
• Swap — the original link or attachment is replaced with a malicious one.
• Pretext — it arrives as a "resend," "updated invoice," or "corrected link," explaining the repeat.
• Trust — because you recognise the message, you are far more likely to click.

Why it beats normal caution

Most phishing advice is about spotting the unfamiliar. Clone phishing inverts that: the message is familiar, which is exactly why it slips through. If the original came from a trusted brand, the clone inherits that trust — and the swapped link often leads to a cloaked page that looks clean to scanners.

How to defend

1. Authenticate your domain (SPF, DKIM, DMARC) so attackers struggle to send clones as you.
2. Be wary of "resend/updated" messages, especially ones that add urgency.
3. Verify links out of band before acting on a repeat of something you already handled.
4. Take down the destination — the swapped link points to a page you can get removed.

The takeaway

Clone phishing succeeds by copying what you already trust and changing only the payload. Authenticate your domain so your messages are hard to clone, treat "resends" with a healthy pause, and remove the pages the malicious links lead to.