The phantasms cannot attack, but they're still going to confuse you
When a Cloaker takes the Phantasms action, it:
magically creates three illusory duplicates of itself if it isn't in bright light. The duplicates move with it and mimic its actions, shifting position so as to make it impossible to track which cloaker is the real one.
The usefulness of these illusory duplicates to the Cloaker is that:
Whenever any creature targets the cloaker with an attack or a harmful spell while a duplicate remains, that creature rolls randomly to determine whether it targets the cloaker or one of the duplicates.
There is no mention that these duplicates are capable of physically attacking, which would be abnormal for illusions, so according to the 5e design principle that 'spells only do what they say they do' it's reasonable to conclude that they cannot attack.
So, when the real cloaker attackers, why is it still confusing as to which is the real one? Surely you know which has bitten you?
Unfortunately you don't. Even after you've been bitten the Cloaker's duplicates are still 'mov[ing] with it', and 'shifting postition' so that 'it is impossible to track which cloaker is the real one'. How you rationalise that is up to you. In my games I often describe it as all of the duplicates frequently appearing to come together and overlap then separate again, so that, even if momentarily you thought you knew which was which, you can't maintain it. You might like to think of it in terms of a game of classic cup and ball misdirection.
But what about when the real one is literally attached to your head? How could you still be confused then?
It does sound a little ridiculous. The not very satisfying answer is that they are still confused by the phantasms, even if that seems counter-intuitive, because the rules say so - because magic. There's no provision in the rules for the Phantasms to be bypassed.
Maybe you can rationalise that for your other PCs, that are just looking on, that the phantasms overlap continously, apparently moving on and off the victim's head. However, you're right, it is hard to argue that the guy actually affected by the bite, wouldn't logically know that one of them was continuously attached to their head and that that one must be the real one - and thus the victim at least shouldn't be at risk of targeting a Phantasm instead.
If you want to rule it that way at your table, then, while I think it is clearly against rules as written, that's up to you. Doing so probably wouldn't be too unbalancing, as they'll still have disadvantage on their attack due to being blinded.
So, you want to attack it, how do you determine what you hit?
Anyone that makes an attack against the Cloaker while its duplicates are active, 'rolls randomly to determine whether [they] target[s] the cloaker or one of the duplicates'. As the roll is random it doesn't really matter who makes it - but as the attacker will normally a PC, it's probably more satisfying for them to do it.
The odds of whether you hit the Cloaker or its duplicates instead are not directly specified. So, how you resolve that roll at your table is up to you.
Sdjz's suggestion, in their answer, is perfectly sensible. An approach which I use at my table, and which has the advantage of using a d20, is to borrow from the rules specified in the related Mirror Image spell, that produces a very similar effect to the Cloaker's Phantasms action:
Each time a creature targets you with an attack during the spell's duration, roll a d20 to determine whether the attack instead targets one of your duplicates.
If you have three duplicates, you must roll a 6 or higher to change the attack's target to a duplicate. With two duplicates, you must roll an 8 or higher. With one duplicate, you must roll an 11 or higher.
In the case of Mirror Image the roll is made by the target not the attacker but this otherwise works well - though it does give a very slight advantage to the attacker when two duplicates remain (35% to hit Cloaker, rather than 33.3%).
