How do I detect conversation hijacking in email threads?

What conversation hijacking looks like in an email thread

Conversation hijacking is usually a takeover of an existing reply chain, not a brand-new phishing message. The attacker benefits from trust already built into the thread, so the content often looks ordinary while small details change: sender path, reply behaviour, mailbox rules, forwarding, or the account used to send the next message. That is why thread integrity matters more than subject line familiarity.

The strongest detection mindset is to compare the current message against the thread’s normal baseline. A genuine continuation usually matches the sender’s usual sending pattern, language, device, and location, while a hijacked reply often introduces a new access path or a lookalike identity. In practice, that means checking whether the reply really came from the expected mailbox and whether the sending context fits the account history.

For defenders, conversation hijacking is easiest to spot when you stop treating email as a single event and start treating it as a sequence of mailbox actions. Top 10 Email Security Threats is useful here because it places thread hijacking alongside lookalike domains, OAuth consent phishing, and malicious inbox rules as related email abuse patterns.

Which mailbox signals are most useful for detection?

The most actionable signals are the ones that show a mismatch between the message and the account’s normal behaviour. Mail trace logs can reveal whether the message was relayed through an unusual path, while mailbox auditing can show rule creation, forwarding changes, or consent activity that should not be present. Sudden changes in reply timing, especially when paired with a new device or geography, are often a better clue than content alone.

Look for inbound and outbound messages that appear consistent at the surface but diverge underneath. A hijacked account may reply from a browser session, a new OAuth token, or a mail client that has not been used before. If the thread suddenly shifts to a payment request, attachment exchange, or credential prompt, treat that as context, not proof, and verify the mailbox activity that produced the reply.

Threat hunting is more efficient when you connect the message to the account-control layer. The MITRE ATT&CK T1586 Compromise Accounts Guide is a strong fit because it ties hijacked email behaviour to inbox forwarding rule detection, compromised account use, and trusted-sender abuse. MITRE ATT&CK Guide for Defenders adds the broader detection workflow for mapping those mailbox events to ATT&CK technique coverage.

How do you confirm the reply was malicious rather than just unusual?

Confirmation usually comes from correlation, not from one signal. If the thread reply came from a compromised account, you should be able to line up the message with an anomalous sign-in, an unexpected OAuth grant, a new inbox rule, or a forwarding change. If it came from a lookalike address, the evidence tends to show identity mimicry instead of mailbox control, even when the wording is polished and the thread context is plausible.

The practical test is whether the account and the message history tell the same story. A legitimate reply should fit the account’s normal authentication, authorisation, and mailbox behaviour. A hijacked reply often shows a mismatch between who appears to be speaking and which mailbox actions actually occurred. That is why you should validate message headers, mailbox audit events, and sign-in telemetry together before concluding that the thread is safe.

MITRE ATT&CK T1566 Phishing is useful because thread hijacking often follows the same credential and consent pathways as phishing, even when the final abuse is an email reply from a trusted account.

Risk and Threat Considerations

Conversation hijacking is risky because it weaponises an existing trust relationship, which makes it more likely to bypass normal caution and less likely to be questioned quickly. The main exposure is not just message fraud, but the possibility that an attacker has already obtained mailbox access, forwarding capability, or delegated consent that can be reused across more than one conversation.

Failure mechanism: The attacker either compromises the mailbox directly or gains a persistent mail path, then uses the trusted thread to continue the deception while hiding behind normal reply behaviour.

Impact: The result can be payment diversion, credential theft, data exposure, or lateral abuse of the compromised account’s existing trust relationships, often before recipients realise the thread has been altered.

Practitioner Guidance

What to prioritise: Start with messages that combine a high-trust thread, a new reply path, and any mailbox-control change such as rule creation, forwarding, or OAuth consent. Those cases are more important than generic spam because they indicate the mailbox itself may be part of the attack path.

What to verify: Confirm whether the reply aligns with the sender’s normal device, location, and authentication history, and whether mail trace and audit logs show a change that explains the thread shift. If the message is inconsistent but the mailbox looks clean, re-check for lookalike sender abuse and external forwarding.

Practitioner takeaway: The most reliable detection comes from proving whether the thread reply is consistent with mailbox behaviour, not just whether the text looks believable.

Related resources from NHI Mgmt Group

• Detect
• How should security teams detect conversation hijacking used to deliver malware through email?
• How should security teams detect email thread hijacking when attackers reuse an existing conversation to request payment or access changes?
• How should security teams detect a loader-based phishing attack that uses hijacked email threads and cloud storage links?