Attack where a legitimate email is copied and resent with malicious links or attachments substituted.
Clone phishing involves attackers copying a legitimate email the victim has previously received and resending it with malicious links or attachments substituted for the originals. The attacker claims the email is a resend or updated version. Because the email format, content, and sender appear familiar, victims are more likely to trust it. Clone phishing requires attackers to have access to previous correspondence, often obtained through earlier compromises or by monitoring email traffic.
Why It Matters
The DSC Perspective:
Clone phishing exploits trust in familiar communications. If a previous email was legitimate, users assume the 'updated' version is too. Teach users to verify unexpected resends and be suspicious of requests to re-click links or re-download attachments.