Clone phishing vs. spear phishing vs. BEC
Clone phishing is often used alongside related terms, and one incident can combine all three. Spear phishing is a message tailored to one person or organization, and it may use cloning. Business Email Compromise (BEC) impersonates an executive or supplier to redirect payments, often with no link at all. Mass phishing sends generic messages to many recipients without personalization.
Clone phishing is the narrowest of these terms: the attacker reuses a genuine message to steal credentials, deliver malware, or commit fraud. When the message succeeds, the result is often a data breach that starts with a stolen login rather than a stolen file.
How clone phishing works
The attack starts with a real message, taken from a compromised mailbox, a captured thread, or the same newsletter the target receives. The message is reproduced almost exactly, including the sender name, subject, wording, and images, and sent as a reply inside the original conversation.
The only meaningful change is the payload, and that is where the attack pays off. The copy is often framed as an update, such as a corrected invoice or a resend of a file that supposedly failed to open. The stolen login then leads to data exfiltration, the stage that controls can still see.
- 1
Take a genuine message
The attacker copies a real email from a compromised mailbox or a captured thread.
- 2
Reproduce it closely
The sender name, subject, wording, and images are copied, and the reply stays in the original conversation.
- 3
Replace the payload
The link or attachment leads to a malicious site or file, and everything else stays the same.
- 4
Give a reason to act
A corrected invoice or a resend of a failed file gives the recipient a reason to click.
Indicators of a cloned email
A cloned message is built to survive a quick glance, so the details that expose it are small. The table weighs each sign by how hard it is to fake:
| Sign | What it looks like | Weight |
|---|---|---|
| Duplicated conversation | The same or an updated email arrives twice, though the original needed no follow-up | Weak alone |
| Slightly altered links | Link text matches the original, but the real address uses another domain | Strong signal |
| Replaced or reattached files | Same name, different format or size, or an executable or macro twin | Strong signal |
| Manufactured urgency | A correction or resend that pushes for immediate action | Weak alone |
| Authentication anomalies | Fails SPF, DKIM, or DMARC checks, or uses a lookalike domain | Strong signal |
| Header and formatting traces | Odd send time, message ID, or reply-to, missing thread history, copy-paste artifacts | Check first |
Why clone phishing is effective
The technique works because it steals context instead of inventing it. Training teaches people to distrust unexpected mail, but a clone feels expected: the recipient has already seen the original and probably trusted it. The copied layout, sender name, and thread history do the persuading.
It also complicates technical defense. Mail filters find much that looks legitimate in a clone, such as real branding, real text, and a real conversation, so the malicious difference is small. After a successful click, attackers reach for sensitive data through the access they gained.
Training alone does not stop a clone, because it reuses a message the recipient already trusted.
Protection measures
No single control stops clone phishing. Effective programs combine independent layers, and each one covers a different stage of the attack:
| Control | Scope | What it does |
|---|---|---|
| Phishing awareness trainingPeople who read mail | All staff | Verify resends, check link targets, treat urgency as a warning |
| Multi-factor authentication (MFA)Account sign-in | All accounts | Makes stolen credentials less useful; phishing-resistant factors beat SMS codes |
| SPF, DKIM, and DMARCSender domain records | Mail domain | Makes spoofing harder and gives receivers grounds to reject mail |
| Mail filtering and sandboxingInbound gateway | Inbound mail | Opens attachments in isolation, inspects links, flags anomalies |
| Reporting and responseSecurity process | Security team | One-click reporting and a rehearsed process to revoke sessions and reset credentials |
| Least privilege and verificationPayment and account changes | Finance and admins | Out-of-band confirmation for payment and account changes |
What it looks like in Anexet
Anexet does not score senders or URLs, but it does intercept mail on monitored endpoints. Through email interception, the administrator sees the body and the attachments of a message, which is where a swapped file shows up. Captured messages can then be searched in the investigation console to see what left the company.
Where to start
Start with the data that would hurt most if it leaked through a data leak, then with the mail channels that carry it. A cloned message only has to look familiar once, so the controls that matter most are the ones that see what leaves afterwards and can stop it.
Pair mail security, MFA, and training with monitoring of endpoint channels, so an incident can be traced and contained early.
Further reading: Phishing — key trends in 2025; Social engineering vs. DLP Systems: how to protect your company from Data Breaches.
A cloned email only has to look familiar once. The damage comes afterwards, and that is where controls must work.
Anexet TeamHow Anexet handles this
Anexet is not an anti-phishing mail gateway: it does not classify senders, inspect URLs, or score messages for phishing intent. Its relevance here lies in the mechanics it does have: interception and content analysis of mail and attachments on monitored endpoints, and detection of the data transfers that follow a compromise.
When an employee falls for a cloned message, the aftermath is data movement: files leaving through mail, web, cloud storage, or removable media. Anexet's DLP module monitors those channels and analyzes the content of what is sent, making containment and investigation possible.
Mail interception and content analysis
endpoint agents capture email traffic, including webmail and mail clients, and analyze message and attachment content against security dictionaries, hash banks, digital fingerprints, and sensitivity labels, a malicious twin can be flagged by what it contains, not who sent it.
Detection of data transfers
security policies watch sensitive content moving through email, web, cloud applications, messaging, printing, clipboard, and removable devices, and can block, quarantine, or alert, limiting what leaves after the initial click.
Audit trail for investigation
every intercepted event is recorded with user, timestamp, channel, and content classification, a full, attributable audit trail of what passed through an endpoint and what data left.
Honest boundaries
preventing the clone itself remains the job of mail security, MFA, and training; Anexet adds visibility into endpoint channels and control over the data movement that follows.
Anexet DLP
Learn more