Cloning attacks in cybersecurity, also known as a clone phishing, is a type of targeted attack that implies copying an email sent from a legitimate organization.

Such emails usually contain malicious links or attachments. The key goal of such an attack is to make victims believe in the legitimacy of the sender and click on those links.

Unsurprisingly, cryptocurrency users often become targets of cloning attacks, too. Irreversibility of transactions combined with a number of privacy-oriented solutions enables hackers to easily get away with precious assets.

How can an individual or an organization withstand clone phishing attacks?

What kind of security measures can crypto users implement to avoid losing their funds?

Read on to find out.

What is Clone Phishing?

Clone phishing is a type of cyberattack in which criminals copy a legitimate email, website, or increasingly, a voice or video communication, and use it to trick targets into handing over credentials, authorizing wire transfers, or installing malware.

What separates clone phishing from generic phishing is the level of personalization and realism. Attackers study their target, replicate known communication styles, and in 2025-2026, use AI-generated voice clones and deepfake video to impersonate real executives or colleagues in live calls and Zoom meetings.

This evolution means clone phishing is no longer just an email problem. It is now a multi-channel threat that combines spoofed emails, cloned voices, and fake video calls in a single coordinated campaign. AI tools that generate convincing voice replicas from as little as three seconds of audio are now widely accessible to opportunistic attackers, not just sophisticated state-sponsored groups.

How Bad Is the Clone Phishing Problem Right Now?

The scale of clone phishing and its AI-powered variants has grown dramatically. Here is what current data shows:

Deepfake-enabled fraud caused more than $200 million in losses in early 2025, according to a Resemble AI analysis reported by Security Magazine.
Deepfake fraud attempts surged 1,300% in 2024, according to Pindrop's Voice Intelligence Report, with banking-sector voice fraud rising by double digits year-over-year.
The U.S. Federal Trade Commission flagged tens of thousands of voice-cloning-related complaints in 2025.
German federal law enforcement (BKA) formally classified voice cloning as a distinct modus operandi in CEO fraud cases by 2025.
GetReal Security research found that 41% of enterprises surveyed had unknowingly hired and onboarded fraudulent candidates using deepfake identities, illustrating how far the attack surface has expanded.

These numbers reflect a threat that has moved well beyond opportunistic email scams. Finance departments, HR teams, and crypto holders are now the primary targets of coordinated, AI-assisted impersonation campaigns.

How Does Cloning Attack Work?

Despite its complexity, a cloning attack remains one of the most efficient methods and, therefore, very popular.

Even a trained user can easily miss the signs of a scam. And there’s nothing to surprise at. Here are some of the key techniques that scammers rely on:

First of all, attackers usually copy a well-known brand that most of us have heard of. The key goal is to mislead users into thinking that they are contacted by this brand.
Next, attackers send cloned email messages to large numbers of recipients. The message will look like an ongoing conversation with a legit company.
The email that attackers send prompts its victims to click on a malicious link or download a file.

Once the trap is closed, attackers are free to do whatever they please.

If it’s an organization they target, they may infect a corporate network with a virus. If it’s an individual, he or she may be asked to expose some personal data that attackers use afterward for their own criminal purposes.

The Modern Multi-Channel Attack: How AI Has Changed Everything

Traditional clone phishing involved copying an email. Modern clone phishing campaigns layer multiple channels in a single attack sequence. Here is how a typical 2025-2026 executive impersonation campaign unfolds:

Reconnaissance: Attackers scrape the target's LinkedIn, company website, and public earnings calls to map the org chart and gather audio or video samples of the executive they plan to impersonate.
Voice or video clone creation: Using publicly available AI tools, attackers generate a convincing voice clone from as little as three seconds of audio. Some campaigns use deepfake video overlays for Zoom calls.
Spoofed email setup: A cloned email address (e.g., ceo@company-corp.com vs. ceo@company.com) is used to initiate the chain, establishing context before the call.
Live impersonation call: The target receives a call or Zoom meeting request appearing to come from the executive. The AI-generated voice instructs the employee to wire funds, share credentials, or install a remote access tool.
Urgency and secrecy: The attacker frames the request as time-sensitive and confidential, discouraging the target from verifying through normal channels.

In one documented 2026 campaign, attackers combined cloned CEO voices, spoofed Zoom calls, and a malicious IT troubleshooting program to compromise targets across multiple organizations.

Cloning Attack Examples

The most common examples of a cloning attack look as follows.

Attackers send an urgent email that looks like an ongoing conversation with customer support of a well-known company such as PayPal or Microsoft.

The subject line and the content of the email itself come with a sense of urgency. Attackers love using such words as “now”, “asap”, “immediately”, etc. This psychological trick should make the victim do the desired action without thinking too much about the consequences.

As for the content of the message, it may come in many different forms.

For example, a poofed email may promise a refund for some previous purchases. In order to get it, users have to visit the website by the provided link and submit their banking details or other sensitive data.

Another example of a cloning attack is a fake virus alert. At this, the email may look like the one from Facebook or Apple. It may notify the user that the device is infected and provide a malicious link for downloading an antivirus.

Needless to say that what the user will eventually get is just the opposite.

Clone Phishing vs. Traditional Phishing vs. CEO Fraud

Many terms are used interchangeably but they describe distinct threats with different risk profiles and required defenses.

👉 Quick takeaway: Traditional phishing targets anyone with generic lures. AI voice clone phishing targets executives with deepfake audio and video, and caused $200M+ in sector-wide losses in 2025. The defenses are different for each — generic email filters do nothing against a convincing phone call from a cloned CEO voice.

Attack Type	Channel	Impersonation Method	Typical Target	Average Loss Risk	Key Defense
Traditional Phishing	Email	Generic brand spoofing	Anyone	⚠️ Low–Medium Credential theft	Email filters, link checking
Clone Phishing	Email + cloned website	Exact copy of legitimate email	Individuals, employees	⚠️ Medium Credential / data theft	Sender verification, MFA
Spear Phishing	Email	Personalized to target	Specific employees	⚠️ Medium–High	Security awareness training
CEO Fraud / BEC	Email + phone	Executive impersonation	Finance, HR teams	🔴 High Wire fraud: $50K–$25M+	Out-of-band verification, approval policies
AI Voice Clone Phishing	Phone + Zoom + email	AI-generated voice / video deepfake	Executives, finance teams	🔴 Very High $200M+ sector-wide in 2025 🔴 Highest loss risk in table	Phishing-resistant MFA, verbal codewords, call-back policy ⚠️ Email filters do not protect against this attack

How to choose the right defense: The channel of the attack determines the required control. Email-only attacks are stopped by email hygiene. Voice and video attacks require out-of-band verification, meaning you must confirm the request through a separate, pre-established channel before taking any action.

Cloning Attacks in Crypto

Cryptocurrency users remain high-value targets for clone phishing because transactions are irreversible and pseudonymous, making recovery nearly impossible once funds are moved.

Current crypto-specific clone phishing patterns (2025-2026):

Fake exchange security alerts: Attackers clone emails from Coinbase, Binance, or Kraken warning of suspicious account activity. The linked page is an exact replica of the exchange login, capturing credentials and two-factor codes in real time.
Cloned wallet interfaces: Malicious browser extensions or websites replicate MetaMask, Phantom, or Ledger Live. Users attempting to restore access are prompted to enter their seed phrase, which is immediately harvested.
AI voice impersonation of exchange support: In 2025-2026, attackers began calling crypto holders while impersonating exchange support staff using AI-cloned voices, directing victims to a 'verification portal' that captures credentials.
Deepfake crypto influencer scams: AI-generated video clones of well-known crypto figures are used in live-streamed 'giveaway' events, directing viewers to phishing sites.

The 2022 SeaFlower campaign documented by Confiant, which cloned MetaMask and Coinbase wallet apps to steal seed phrases, established the template that more sophisticated AI-assisted variants now follow. If you entered your seed phrase on any unverified site, treat that wallet as compromised and move funds to a new wallet immediately.

How To Recognize a Cloning Attack

As technologies evolve, clone phishing in cyber security gets more sophisticated by the year.

Still, if you stay on guard, you will be able to easily recognize a scam. Here are the warning signs of a cloning attack that must make you alert:

The message comes with a sense of urgency. It prompts recipients to act quickly inviting them to click on the links or download attachments.
The email invites recipients to obtain a reward, participate in some promotion or get a discount.
The message contains grammatical or spelling errors.
The sender’s address is practically a full replica of the one in a legitimate email. Yet, it comes with slight modifications.
Attackers usually rely on free email addresses that end with “@gmail.com” instead of “@companyname.com”.

How to Spot AI Voice Clone and Deepfake Phishing Specifically

Recognizing AI-generated voice or video impersonation requires different cues than spotting a fake email. Watch for these specific warning signs during unexpected calls or video meetings:

Audio red flags:

Slight robotic cadence or unnatural pauses between words
Background noise that sounds processed or static
Voice that matches the person but emotional tone feels flat or mismatched
The caller discourages you from hanging up to verify through another channel

Video call red flags:

Facial edges that blur or flicker, especially when the person moves quickly
Eyes that do not track naturally or blink at irregular intervals
Lighting on the face that does not match the background environment
Requests to turn off your camera while keeping theirs on

Request pattern red flags (apply to all channel types):

Urgency combined with a request for secrecy ('do not tell anyone about this yet')
Wire transfer, gift card purchase, or credential sharing requested verbally without written follow-up
Request to install remote access software to 'fix an issue'
Pressure to bypass normal approval workflows

If you notice any of these signals, end the communication and verify the request through a pre-established, separate channel such as calling the person back on a known number.

How To Protect Yourself from Cloning Attacks

For Organizations: A Layered Defense Framework

Protecting against modern clone phishing requires controls at the technical, procedural, and human levels.

Technical controls:

Deploy phishing-resistant MFA (FIDO2/passkeys) for all accounts with access to financial systems or sensitive data. Standard SMS-based MFA can be bypassed in real-time phishing attacks; phishing-resistant variants cannot.
Implement DMARC, DKIM, and SPF on your email domain to prevent attackers from spoofing your organization's email addresses.
Use AI-based email filtering that detects lookalike domains and cloned email templates.

Procedural controls:

Establish a mandatory out-of-band verification policy: any financial transfer or credential-sharing request received by phone or video call must be confirmed by calling the requester back on a pre-registered number before action is taken.
Create verbal codewords for executives and finance teams to use when confirming high-value requests by phone.
Set a transaction threshold (e.g., any wire transfer above $5,000) that requires dual approval through two independent communication channels.
Conduct quarterly tabletop exercises simulating a CEO voice-clone phishing attempt.

Human controls:

Train employees specifically on AI voice cloning and deepfake video, not just email phishing. Employees should know that a convincing-sounding executive voice on a call is not proof of identity.
Run simulated voice-clone phishing drills in addition to email phishing simulations.
Establish a clear, no-blame reporting channel so employees can flag suspicious requests without fear of appearing uncooperative.

For Individuals: A Practical Checklist

Never provide seed phrases, passwords, or banking details in response to an unsolicited call, email, or video meeting.
If someone calls claiming to be a family member in distress, hang up and call that person directly on their known number before doing anything.
Set up a family verbal codeword for emergency requests involving money.
Use a password manager so that even if you land on a cloned site, your credentials will not autofill on an unrecognized domain.
Enable phishing-resistant MFA on all financial and crypto accounts where available.
If you have already submitted credentials on a suspicious site, change your password immediately on the real platform, revoke active sessions, and contact support.

Real-World Clone Phishing Case Studies

Case Study 1: Deepfaked CEO on Zoom (2026)

A threat actor group used a combination of cloned executive voices, a spoofed Zoom meeting, and a malicious IT troubleshooting program to compromise employees across multiple organizations. The attack began with a spear-phishing email appearing to come from the CEO, followed by a Zoom call in which an AI-generated voice and video likeness of the CEO instructed the target to install a remote access tool under the guise of a security update. The tool gave attackers persistent access to the corporate network.

What stopped similar attacks: Organizations that had implemented a call-back verification policy and trained employees to treat any unsolicited software installation request as suspicious were able to break the attack chain at the Zoom call stage.

Case Study 2: Finance Worker Transfers $25 Million (Hong Kong, 2024)

A finance employee at a multinational firm was invited to a video call that appeared to include several colleagues and the company's CFO. All other participants were deepfake AI constructs. The employee transferred approximately $25 million before the fraud was discovered. This case is widely cited as the largest single deepfake-enabled wire fraud loss on record.

Lesson: No visual or audio verification alone is sufficient. Dual-channel approval for large transfers is the only reliable control.

Case Study 3: Family Distress Voice Clone Scam

Consumers across the U.S. received calls from AI-generated voices replicating the voices of their children or grandchildren, claiming to be in legal or medical distress and requesting urgent wire transfers or gift card purchases. The FTC logged tens of thousands of such complaints in 2025.

What works: Hanging up immediately and calling the family member back on their known number, or using a pre-agreed verbal codeword, stops this attack completely.

Bottom Line

Clone phishing has evolved from copied emails into coordinated, AI-powered impersonation campaigns that combine fake voices, deepfake video, and spoofed platforms in real time. Deepfake-enabled fraud losses exceeded $200 million in early 2025, and the attack surface now extends to phone calls, Zoom meetings, and even job interviews.

The good news is that the defenses are clear and implementable:

Verify any unexpected financial or credential request through a separate, pre-established channel before acting.
Deploy phishing-resistant MFA on all sensitive accounts.
Train your team on voice and video deepfake cues, not just email red flags.
Set a verbal codeword with family members for emergency money requests.

If you found this guide useful, explore our related resources on crypto security and social engineering threats to build a complete personal defense strategy.

Frequently Asked Questions About Clone Phishing

What is the difference between clone phishing and spear phishing?

Clone phishing copies a specific legitimate email and replaces links or attachments with malicious ones. Spear phishing is personalized to the target but does not necessarily clone a real message. Both are more dangerous than generic phishing because they are harder to detect.

Can AI voice cloning be used in clone phishing?

Yes. In 2025-2026, AI voice cloning has become one of the primary tools in executive impersonation and CEO fraud campaigns. Attackers can generate a convincing replica of a person's voice from a few seconds of publicly available audio and use it in live phone calls or Zoom meetings.

Is phishing-resistant MFA effective against clone phishing?

Phishing-resistant MFA (FIDO2 or passkey-based) is highly effective against credential-harvesting clone phishing because it ties authentication to the legitimate domain. Even if a user enters their username and password on a cloned site, the authenticator will not complete the login on an unrecognized domain. It does not, however, protect against social engineering that bypasses authentication entirely, such as wire transfer requests made by phone.

Which industries are most targeted by deepfake clone phishing?

Finance and banking sectors are the most targeted due to direct access to funds. Crypto exchanges and DeFi platforms face elevated risk due to the irreversibility of transactions. HR departments are increasingly targeted for fraudulent hiring and onboarding scams using deepfake video identities.

What should I do if I think I have been a victim of clone phishing?

If you submitted credentials: change your password on the real platform immediately, revoke all active sessions, and enable MFA. If you authorized a wire transfer: contact your bank's fraud department within the hour, as some transfers can be recalled within the first 24-72 hours. If you installed software: disconnect the device from the network and contact IT security or a professional incident response service.

What Is Clone Phishing? How AI Voice and Deepfake Attacks Work