Topic starter
11/11/2026 6:02 pm
TL;DR: A 70% rise in conversation hijacking since 2022, QR code attacks hitting 1 in 20 mailboxes in late 2023, and BEC accounting for 1 in 10 attacks were found in Barracuda's June 2024 analysis of 69 million attacks across 4.5 million mailboxes. The practical lesson is that email defence now has to detect conversational manipulation, not just malicious attachments and links.
Editorial analysis by NHI Mgmt Group, based on content published by Barracuda: “Top Email Threats and Trends”.
By the numbers:
- Barracuda reports a 70% increase in conversation hijacking since 2022.
- Barracuda found that 1 in 20 mailboxes were targeted with QR code attacks in the last quarter of 2023.
- Barracuda says 1 in every 10 attacks were business email compromise.
Key questions
Q: Why does BEC keep working against organisations?
A: BEC keeps working because attackers exploit process trust, not malware.
Q: How can QR codes be abused in phishing campaigns?
A: QR codes in phishing campaigns can hide the destination and bypass simple URL filters, because the user scans a code that resolves to a malicious site or login page.
Q: How do I detect conversation hijacking in email threads?
A: Detect conversation hijacking by looking for mailbox access patterns that do not match the usual sender, device, location, or forwarding behaviour, then verify whether a reply came from a compromised account or a lookalike address.
Practitioner guidance
- Harden conversation-based approvals Require out-of-band verification for payment, banking detail and beneficiary changes even when the request arrives in an existing thread.
- Treat QR codes as hostile payloads Route QR scans through secure inspection and user warning layers so the destination is checked before the browser opens.
- Correlate thread anomalies with identity signals Flag sudden sender changes, unusual reply timing and mailbox access from unfamiliar locations as indicators of conversation hijacking.
Bottom line: Email social engineering is increasingly built around trust reuse inside live conversations, not only around malicious attachments or obvious phishing pages.
Glossary terms: Social Engineering, Conversation Hijacking, Business email compromise, QR Code Phishing
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Email fraud is moving from message delivery to relationship abuse. The report's most important signal is not a single lure type, but the way attackers now exploit established communication context to get past user judgment. That changes email security from a filter problem into a trust-governance problem, especially where mailbox access intersects with finance, procurement and executive authority. Practitioners should treat thread integrity as a control objective, not an email convenience.
A few things that frame the scale:
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: How should organisations verify high-risk requests that arrive by email?
A: Use an independent confirmation step outside the email thread for payments, vendor changes, payroll updates, and other high-impact actions. Verification should check the requester through a separate trusted channel and confirm the business event before any action is taken.
👉 Read our full editorial: GenAI is accelerating email social engineering, not replacing it