Commjacking is the hijacking of a communication channel, such as messaging, email or a browser session, so an attacker can impersonate a legitimate party or redirect the conversation. The compromise usually relies on stolen session credentials, account takeover or manipulation of trust in the channel.
What Commjacking Is and Why It Matters
Commjacking is not simple eavesdropping, it is a control of the conversation itself. Once an attacker can impersonate a legitimate party or steer a thread into a different channel, they can alter decisions, approvals, support outcomes, and trust assumptions in real time.
The security significance comes from the fact that the channel often carries more than text. Email, chat, and browser-based sessions frequently convey identity, intent, and implied authority, so compromise of the channel can become a compromise of the relationship behind it.
How Commjacking Usually Happens
Commjacking typically depends on stolen session credentials, account takeover, or manipulation of a trusted communication path. The attacker does not always need to break encryption or defeat the application itself; it is often enough to reuse an authenticated session, hijack a mailbox, or intercept a live browser conversation.
This makes commjacking especially dangerous in environments where users rely on the channel to confirm transactions, share links, approve actions, or exchange sensitive information. If the channel is assumed to be authentic, the attacker can exploit that assumption without having to look obviously malicious.
Common Impact on Organisations and Users
The main impact is deception at the point where people decide what to believe. A hijacked communication channel can be used to redirect payments, issue fraudulent instructions, lure a victim into revealing more credentials, or suppress legitimate messages that would expose the compromise.
It can also create operational confusion. Teams may act on forged updates, miss urgent warnings, or fail to distinguish a genuine contact from an attacker using the same channel and style of communication.
What Makes Commjacking Hard to Detect
Commjacking is difficult because the traffic often looks normal once the session is established. The attacker may be using valid credentials, a legitimate account, or a browser context that already carries trust, which means content filters and perimeter controls may not see anything unusual.
Detection therefore depends on behavioural and contextual signals, such as unexpected device changes, unusual session geography, new forwarding rules, changes in message delivery patterns, or conversation threads that suddenly shift tone, destination, or request type.
Risk and Threat Considerations
Commjacking is risky because it attacks trust rather than only technology. When an attacker controls the channel, they can sustain fraud, social engineering, and follow-on account abuse while appearing to participate in a legitimate conversation.
Failure mechanism: The attacker gains a valid or semi-valid foothold in the communication path, then reuses the existing trust relationship to impersonate one side of the exchange or reroute the dialogue.
Impact: Victims may disclose secrets, approve malicious actions, follow fraudulent instructions, or continue interacting with the attacker long after the original compromise has occurred.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Commjacking often follows compromise of authenticated user sessions. |
| AU-6 — Audit Review, Analysis, and Reporting | Detection of channel hijacking depends on reviewing anomalous sign-ins and session activity. | |
| AC-6 — Least Privilege | Limiting account privilege reduces the damage an impersonated communicator can cause. | |
| Recommendation — Enforce strong user authentication and session protections for communication systems. Correlate authentication and message-activity logs to spot hijacked communication sessions. Restrict account permissions so a hijacked communicator cannot perform high-impact actions. | ||
| NIST CSF 2.0 | DE.CM-02 — Monitoring for Anomalies | Commjacking is often discovered through abnormal session, message, or identity behaviour. |
| Recommendation — Monitor communication channels for anomalous identity, session, and messaging patterns. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account takeover is a common route into communication-channel hijacking. |
| Recommendation — Harden account lifecycle controls and remove stale access paths that enable takeover. | ||
Practitioner Guidance
Why practitioners should care: Treat commjacking as a channel-integrity problem, not only an authentication problem. The channel can remain technically available while the conversation itself has already been subverted.
What to watch for: Review unusual forwarding, session anomalies, out-of-pattern replies, and unexpected changes in message history or browser session context, especially where the communication path carries business approvals or credentials.
Practitioner takeaway: Protecting the account is necessary, but preserving trust in the conversation requires separate attention to session visibility, channel verification, and user confirmation workflows.