Conversation Hijacking.

An email attack in which a criminal injects malicious replies into an existing trusted email thread to deliver malware or fraudulent instructions. It belongs to the Attacks & Threats category of cybersecurity.

An email attack in which a criminal injects malicious replies into an existing trusted email thread to deliver malware or fraudulent instructions.

In conversation hijacking, the attacker first compromises a mailbox or steals an inbox via credential theft, ATO, or a partner breach. They then read existing threads and reply within them, inheriting the trust, subject, and signature of the legitimate sender. The injected message can carry malware (Emotet famously seeded Trickbot via hijacked threads), a payment-redirection request typical of business email compromise, or a follow-up with a credential-harvesting link. Because the reply appears inside an existing exchange, victims and traditional filters lower their guard. Defences include DMARC, MFA on mail accounts, anomaly detection on reply patterns, banner labels for external senders, and out-of-band confirmation for any payment changes.

Defences for Conversation Hijacking typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Email thread hijacking, Reply-chain attack.