Clone phishing begins when an attacker obtains a copy of a legitimate email. They then create a near-perfect clone of this email but with malicious content. This cloned email is sent from a spoofed email address that closely resembles the original sender. The recipient, believing it to be authentic, may click on the links or download attachments, thereby falling victim to the attack.