In short
In conversation hijacking, the attacker replies inside a real email thread, with the subject and history intact, to slip in a link, an attachment, or a change to payment details. It works because the recipient recognizes the conversation. It's detected by looking for replies that break the thread's usual pattern: a different sender, a different tone, an attachment nobody asked for.
What it is and how it happens
The attacker gets access to a mailbox, their own or a vendor's, almost always through credential phishing. From there they read ongoing conversations and reply inside them.
A variant doesn't need access at all: the attacker copies a thread they obtained earlier and forwards it from a look-alike domain, with the full history pasted below. Trojans like Emotet became known for using this technique at scale.
Why it works so well
- The subject, names and history are real, so the message looks like the natural continuation of the conversation.
- If it comes from a vendor's real account, it passes SPF, DKIM and DMARC without issue.
- The person already trusts the other party and lowers their guard.
Warning signs
- A generic reply ("check the attached document") that doesn't fit what was being discussed.
- A compressed, password-protected, or unusually formatted attachment.
- The sender's address changed slightly, even if the display name is the same.
- A change to bank details right when a payment is pending.
- An old conversation that suddenly "comes back to life."
What to do
- Confirm any payment change or unexpected request by phone, even if it arrives inside a familiar thread.
- If the message comes from a vendor's real account, let them know: their mailbox is probably compromised.
- If the email went out from an account on your server, follow the steps in the credential phishing guide.
- Use a filter that evaluates each reply in the context of the thread. Clisec detects replies that break the usual pattern of an ongoing conversation.
Frequently asked questions
How do attackers get my conversations?
Usually by compromising a mailbox, yours or someone you write to, with a fake login page. Other times they come from earlier data breaches.
Does DMARC protect against this?
Only partly. If the attacker writes from the genuinely compromised account, the email is technically authentic and passes DMARC.
Protect every account on your server
Clisec detects replies that break the usual pattern of an ongoing conversation, across every account on your cPanel server.