What is thread hijacking?

How does thread hijacking work?

Thread hijacking is an attack where a threat actor gains access to an email account and inserts themselves into an existing conversation. The attacker replies within the thread to make communication appear legitimate and increase the likelihood that the request will be trusted.

The Canadian Anti-Fraud Centre says fraudsters infiltrate or spoof an email account and create a rule that sends copies of incoming mail to an account of their own.

From the copies they learn who pays whom, when invoices fall due and how people write. The account they read may be yours, a client's or a supplier's.

Why is it hard to spot?

Fraudsters will infiltrate or spoof a business or individual's email account and create a rule to send copies of incoming emails to one of their own accounts.

The request arrives inside a conversation you recognise, with the right names, amounts and dates. It may come from the real account or from a spoofed address that copies it, so check the sender's address on every reply that asks for money.

The Anti-Fraud Centre adds that fraudsters launch the attack when the owner of the account cannot easily be reached by email or by phone.

What can I do about it?

Fraudsters launch their attack when the owner of the email account can't be easily contacted by email or by phone.

1. Confirm any new or changed bank details by phone, on a number you already have.
2. Check your mailbox for rules that forward or copy mail to an outside address.
3. Turn on multi-factor sign-in for every email account in your firm.
4. Report a suspected attempt to the Canadian Anti-Fraud Centre and to your bank at once.