{"id":30584,"date":"2019-04-24T17:41:27","date_gmt":"2019-04-24T13:41:27","guid":{"rendered":"https:\/\/www.msp360.com\/resources\/?p=30584"},"modified":"2021-12-28T21:34:24","modified_gmt":"2021-12-28T17:34:24","slug":"clone-phishing","status":"publish","type":"post","link":"https:\/\/www.msp360.com\/resources\/blog\/clone-phishing\/","title":{"rendered":"Clone Phishing Explained"},"content":{"rendered":"<p>Attempts to infiltrate malware onto computers systems typically come from one of two sources: email and web sites. The most effective often use both. Phishes are one type of email used to attempt to get users to click on a link that will either get them to install malware or enter user credentials that can be used to infiltrate a real website.<!--more--><\/p>\n<p>These links or programs can install ransomware, sniffers, or Trojans that can steal information or hold it for ransom. These threats cost companies millions of dollars every year, and unfortunately, anti-virus programs may not catch all the threats.<\/p>\n<p>For more information about phishing please refer to our guide on the topic:<\/p>\n<p><span class=\"further-reading \">Further reading<\/span>\u00a0<a href=\"https:\/\/www.msp360.com\/resources\/blog\/anti-phishing\/\">Anti-Phishing Guide<\/a><\/p>\n<blockquote><p>The best way to prevent a malware infection is to keep a user from inadvertently downloading malware in the first place.<\/p><\/blockquote>\n<p>Phishes, in general, mock the look of genuine emails from legitimate sources, whether banks, corporate portals, online retailers, or other websites. Basic phishes mock the look of a legitimate email but generally won\u2019t include an actual username or a person\u2019s full name, address, or other information.<\/p>\n<p>Spear phishes were the next generation of phishes, and they are specifically targeted to individuals, with enough information to appear legitimate at first glance, including the recipient\u2019s full name, phone number, email address, etc.<\/p>\n<p><span class=\"further-reading \">Further reading<\/span>\u00a0<a class=\"in-cell-link\" href=\"https:\/\/www.msp360.com\/resources\/blog\/spear-phishing-prevention\/\">How to Prevent Spear Phishing Attacks<\/a><\/p>\n<div class=\"call-to-action\">\n<div class=\"call-to-action__left\">\n<div class=\"call-to-action__tag\">FREE ASSETS<\/div>\n<div class=\"call-to-action__title\">MSP\u2019s Assets to Stay Safe from Phishing<\/div>\n<div class=\"call-to-action__text\">Check out our assets that will help you to minimize the risk of a phishing attack, reduce the possible damage and increase\u00a0security awareness.<\/div>\n<!--HubSpot Call-to-Action Code --><span class=\"hs-cta-wrapper hs-cta-deferred\" id=\"hs-cta-wrapper-a13a0279-a667-42d1-8ecd-608964d3c162\" data-portal=\"5442029\" data-id=\"a13a0279-a667-42d1-8ecd-608964d3c162\"><span class=\"hs-cta-node hs-cta-a13a0279-a667-42d1-8ecd-608964d3c162\" id=\"hs-cta-a13a0279-a667-42d1-8ecd-608964d3c162\"><!--[if lte IE 8]><div id=\"hs-cta-ie-element\"><\/div><![endif]--><a href=\"https:\/\/cta-redirect.hubspot.com\/cta\/redirect\/5442029\/a13a0279-a667-42d1-8ecd-608964d3c162\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" class=\"hs-cta-img\" id=\"hs-cta-img-a13a0279-a667-42d1-8ecd-608964d3c162\" style=\"border-width:0px;\" src=\"https:\/\/no-cache.hubspot.com\/cta\/default\/5442029\/a13a0279-a667-42d1-8ecd-608964d3c162.png\" alt=\"CTA\"><\/a><\/span><\/span><!-- end HubSpot Call-to-Action Code -->\n<\/div>\n<div class=\"call-to-action__right\"><img decoding=\"async\" style=\"max-width: 300px;\" src=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2019\/06\/Phishing_CTA-1.png\" alt=\"WP icon\" \/><\/div>\n<\/div>\n<h2>Clone Phishing Definition<\/h2>\n<p>The next attempt to lull the recipient\u2019s suspicions beyond spear phishes is the <strong>clone phishing<\/strong>. This uses an actual email that might have been intercepted as part of a legitimate stream of correspondence between a legitimate sender and the recipient that the bad actor is attempting to fool. Clone phishing can refer to a previous message that the recipient sent to the legitimate sender.<\/p>\n<p>To find out about other phishing types and techniques, check out our corresponding guide<\/p>\n<p><span class=\"further-reading \">Further reading<\/span>\u00a0<a class=\"in-cell-link\" href=\"https:\/\/www.msp360.com\/resources\/blog\/types-of-phishing\/\">Methods and Types of Phishing Attacks<\/a><\/p>\n<h2>What Does Clone Phishing Look Like?<\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-30586 size-full\" src=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2019\/04\/How-does-clone-phishing-email-look-like.png\" alt=\"Clone phishing\" width=\"833\" height=\"309\" srcset=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2019\/04\/How-does-clone-phishing-email-look-like.png 833w, https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2019\/04\/How-does-clone-phishing-email-look-like-300x111.png 300w, https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2019\/04\/How-does-clone-phishing-email-look-like-768x285.png 768w, https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2019\/04\/How-does-clone-phishing-email-look-like-624x231.png 624w\" sizes=\"auto, (max-width: 833px) 100vw, 833px\" \/><\/p>\n<ul>\n<li style=\"font-weight: 400;\">Sent from an email address spoofed to appear to come from the original sender<\/li>\n<li style=\"font-weight: 400;\">The attachment or link within the email is replaced with a malicious version<\/li>\n<li style=\"font-weight: 400;\">It may claim to be a resend of the original or an updated version to the original.<\/li>\n<\/ul>\n<h2><a name=\"measures\"><\/a>Preventative Measures<\/h2>\n<p>Two similar methods can be used to stop clone phishing. One filters all spam emails, and the other looks for mismatches between displayed URLs and actual links in the messages, as well as between the apparent sender and the actual sender.<\/p>\n<p>The first is typical of an anti-spam appliance, while the second is typical of a unified threat management solution or firewall. While either solution can stop 99% or more of phishing emails, it\u2019s always possible that clone phishing or another malicious email might slip through, so it\u2019s a good idea to educate users on how to spot a malicious email as well.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-30587\" src=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2019\/04\/Clone-Phishing-Protection-Software.png\" alt=\"Clone Phishing Protection Software\" width=\"833\" height=\"358\" srcset=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2019\/04\/Clone-Phishing-Protection-Software.png 833w, https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2019\/04\/Clone-Phishing-Protection-Software-300x129.png 300w, https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2019\/04\/Clone-Phishing-Protection-Software-768x330.png 768w, https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2019\/04\/Clone-Phishing-Protection-Software-624x268.png 624w\" sizes=\"auto, (max-width: 833px) 100vw, 833px\" \/><\/p>\n<p>For more phishing prevention best practices please refer to our corresponding guide:<\/p>\n<p><span class=\"further-reading \">Further reading<\/span>\u00a0<a class=\"in-cell-link\" href=\"https:\/\/www.msp360.com\/resources\/blog\/how-to-prevent-phishing\/\">Guide on How to Prevent Phishing<\/a><\/p>\n<h2>Signs That Can Help to Detect Malicious Email<\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignleft wp-image-30588 size-full\" src=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2019\/04\/Clone-phishing.png\" alt=\"Clone phishing\" width=\"168\" height=\"190\" \/>Hovering over a link in an email will show the actual URL, as opposed to the displayed link which may have nothing to do with the real email. The email program can also be set to display the actual sender rather than an alias \u2013 this will give a good indication that the email has been spoofed if the email address in the from box does not match the expected sender based on the original thread of the email.<\/p>\n<p><span class=\"further-reading \">Further reading<\/span> <a href=\"https:\/\/www.msp360.com\/resources\/blog\/coronavirus-phishing-awareness-guide\/\">Coronavirus Phishing Awareness Guide<\/a><\/p>\n<h2>Educate Your End-Users<\/h2>\n<p id=\"last\">Regular training is the most effective method of keeping users apprised of the latest versions of malicious emails and other potential threats to corporate security. Educated users have a smaller chance of clicking on a malicious link or opening a malicious attachment. Since no security program finds every threat every time, this adds a needed dimension to corporate security.<\/p>\n<div id=\"slidebox\"><a class=\"close\">\u00a0<\/a><!--HubSpot Call-to-Action Code --><span class=\"hs-cta-wrapper hs-cta-deferred\" id=\"hs-cta-wrapper-015aca63-e776-436f-9ef1-337ab4cf6692\" data-portal=\"5442029\" data-id=\"015aca63-e776-436f-9ef1-337ab4cf6692\"><span class=\"hs-cta-node hs-cta-015aca63-e776-436f-9ef1-337ab4cf6692\" id=\"hs-cta-015aca63-e776-436f-9ef1-337ab4cf6692\"><!--[if lte IE 8]><div id=\"hs-cta-ie-element\"><\/div><![endif]--><a href=\"https:\/\/cta-redirect.hubspot.com\/cta\/redirect\/5442029\/015aca63-e776-436f-9ef1-337ab4cf6692\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" class=\"hs-cta-img\" id=\"hs-cta-img-015aca63-e776-436f-9ef1-337ab4cf6692\" style=\"border-width:0px;\" src=\"https:\/\/no-cache.hubspot.com\/cta\/default\/5442029\/015aca63-e776-436f-9ef1-337ab4cf6692.png\" alt=\"CTA\"><\/a><\/span><\/span><!-- end HubSpot Call-to-Action Code --><\/div>\n<p><span class=\"further-reading \">Further reading<\/span> <a href=\"https:\/\/www.msp360.com\/resources\/blog\/anti-phishing-training-importance-explained\/\">Not Offering Anti-Phishing Training? Why Not?<\/a><\/p>\n<h3>Tell Users What They Should Do to Avoid Problems Once a Phishing Email Has Been Received<\/h3>\n<p>Some users will click on links despite regular training, and email security systems will occasionally fail to stop such things from getting through. In addition to helping users to identify clone phishing and other malicious emails, it\u2019s also necessary to train them to enter URLs in the browser rather than clicking on links, even when the email seems legitimate.<\/p>\n<h3>Phishing Attack Simulation<\/h3>\n<p>One way to make the point on proper security procedures is to conduct simulated attacks. This creates a clone phish or other type of simulated malicious email and then reports to the email administrator and other leaders on which users succumbed to the attempts to collect credentials or who clicked on links in the email. These users can then be designated for remedial training, hopefully before they click on a malicious link.<\/p>\n<h2>Backup as the Last Line of Defense<\/h2>\n<p>One lesson learned from ransomware infections is that even if the ransom is paid, the files the ransomware encrypted may not be recoverable. In other cases, corporate policy or shortsightedness may prevent the ransom from being paid in the first place. A backup plan that has been well engineered and tested can protect you from the consequences of clone phishing attacks as well.<\/p>\n<h2>Conclusion<\/h2>\n<p>Unfortunately, like the Maginot line, network, and data system security can never provide perfect protection. The best chance a company has of surviving the increasing onslaught of malware is to combine all available technologies, test them thoroughly, educate users, and include backups.<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Attempts to infiltrate malware onto computers systems typically come from one of two sources: email and web sites. The most effective often use both. Phishes are one type of email used to attempt to get users to click on a link that will either get them to install malware or enter user credentials that can [&hellip;]<\/p>\n","protected":false},"author":63,"featured_media":30616,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[877,885],"tags":[],"class_list":["post-30584","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-articles","category-other"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/30584","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/users\/63"}],"replies":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/comments?post=30584"}],"version-history":[{"count":1,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/30584\/revisions"}],"predecessor-version":[{"id":52663,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/30584\/revisions\/52663"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/media\/30616"}],"wp:attachment":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/media?parent=30584"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/categories?post=30584"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/tags?post=30584"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}