Conversation Hijacking

Conversation hijacking — also called thread hijacking — is a social engineering technique in which an attacker inserts a malicious message into a genuine, ongoing conversation. Instead of starting a new pretext from scratch, the attacker replies to a thread the victim already trusts: the subject line is familiar, the quoted history is real, and the request arrives mid-dialogue, where almost nobody re-checks the sender.

How it works

The attack begins with access to a real mailbox or its contents — through credential harvesting, an infostealer, or a previously compromised partner. From there:

1. Reconnaissance. The attacker reads active threads, learning the deal in progress, the invoice cycle, the tone, and who answers whom.
2. Insertion. They reply within a live thread — either from the compromised mailbox itself or from a lookalike domain that mimics one participant, with the real history quoted below.
3. The ask. A "revised" invoice with new bank details, a payment-deadline change, or an attachment "updating" a document already under discussion. Malware operators use the same trick to deliver loaders, because a reply in a known thread defeats both filters and instincts.

Conversation hijacking is what makes vendor email compromise so expensive: the fraudulent bank-detail change arrives inside the genuine procurement thread, from the genuine counterparty's account, at exactly the step in the business email compromise process where such a message is expected.

How to defend against it

• Treat mid-thread changes as new requests. Any message that alters payment details, deadlines, or deliverables gets out-of-band verification — a call to a number on file, never to one in the email — regardless of thread history.
• Watch for subtle sender shifts. Reply-to addresses that differ from the quoted sender and domains one character off are the technique's fingerprints.
• Contain mailbox compromise fast: MFA on email, alerts on new inbox rules and unusual forwarding, and rapid token revocation — the hijacked thread is downstream of a hijacked account.
• Rehearse it. Include reply-chain scenarios in security awareness training, because employees trained only on cold, unsolicited phishing misjudge warm threads completely.