Email Conversation Takeover

Email conversation takeover is an attack in which an adversary who controls a legitimate email account hijacks an existing thread and replies with fraudulent instructions from a sender the recipient already trusts. It is also called conversation hijacking, email thread hijacking, or thread injection. Because the account and the thread are genuine, the fraudulent reply passes SPF, DKIM, and DMARC and reaches the inbox looking like part of a conversation the recipient is already having.

Key takeaways

• Conversation takeover uses a real, compromised (or convincingly faked) email thread, so the message carries inherited trust and no scannable malicious payload.
• It is the reply stage of an account takeover and one of the most effective ways to execute business email compromise (BEC).
• Secure email gateways and native Microsoft 365 and Google Workspace filtering miss it because the sender is authenticated and the content is clean.
• Detection depends on behavioral baselining and correlating identity anomalies (new logins, new mailbox rules) with thread anomalies (changed payment details, tone drift).
• Containment requires organization-wide message retraction, because one hijacked reply usually reaches many recipients at once.

How email conversation takeover works

Conversation takeover is the payoff of an account takeover. The attacker gains control of a mailbox through phishing, credential theft, or a stolen session token, reads the victim's real email to learn tone and context, and then replies inside an active thread to redirect a payment, request credentials, or deliver a malicious link. Hijacked threads typically target an in-flight transaction (an invoice, a wire, a contract, or a shared login) where a redirected instruction looks routine. The attack works because it removes the two cues recipients rely on to spot fraud: an unfamiliar sender and an out-of-context request.

Types of conversation takeover

Conversation takeover appears in three main forms:

• Post-compromise hijack. The attacker controls a real mailbox and replies from inside a genuine thread. This is the most convincing form, because every technical check passes.
• Fabricated thread injection. The attacker builds a fake message history (forged prior replies, real names, and real details harvested from reconnaissance) and starts a "reply" that was never part of a real conversation. No compromise is required, only convincing context.
• Vendor conversation takeover. The attacker hijacks a thread inside a trusted supplier or partner and uses it to defraud that partner's customers. This propagates across organizations and is a leading driver of vendor email compromise.

Why conversation takeover is dangerous

Conversation takeover is dangerous because it defeats the human and technical defenses that catch ordinary phishing. The sender is real, the domain is real, and the thread history is real, so authentication passes, reputation filters see a known-good sender, and the recipient trusts the context. The FBI's Internet Crime Complaint Center consistently ranks business email compromise, which conversation takeover is frequently used to carry out, among the costliest categories of cybercrime. The financial payoff is usually a redirected wire, a fraudulent invoice, or stolen credentials that seed the next takeover.

Warning signs of conversation takeover

• A login appears from a new device, location, or impossible-travel path shortly before a suspicious reply.
• New or hidden mailbox rules forward, delete, or move replies (a move to keep the real user from seeing the fraud).
• A session behaves abnormally, a sign of a stolen session token used to bypass the password and MFA.
• Payment details, banking information, or delivery instructions change inside an existing thread.
• Tone, phrasing, or sign-off drifts from the sender's established style.
• A reply-to address differs from the display sender, or participants are quietly added or removed.
• A dormant thread reactivates with a sudden, time-sensitive financial ask.

How to detect email conversation takeover

Detect conversation takeover by baselining normal behavior for each account and relationship, then flagging deviations rather than scanning content. Behavioral AI models how a sender normally communicates and who they normally communicate with, so a reply that breaks that pattern is caught even when the message is clean and the sender is authenticated. Detection is strongest when identity signals (anomalous logins, new mailbox rules) are correlated with thread signals (changed instructions, tone drift) in the same window, because either one alone is easy to dismiss.

Conversation takeover vs. related terms

Why secure email gateways miss it

Secure email gateways and native Microsoft 365 and Google Workspace filtering miss conversation takeover because they inspect content and sender reputation, both of which are clean in a hijacked thread. There is no malicious attachment to detonate and no spoofed domain to flag, because the message comes from a real, authenticated account with an established sending history. Microsoft 365 EOP misses roughly 293 phishing emails per 100 mailboxes every 30 days, and Google Workspace misses roughly 350, largely from intent-based and post-compromise attacks that carry no scannable payload.

How to prevent conversation takeover

Preventing conversation takeover takes layered defenses across identity and email:

• Harden accounts. Enforce phishing-resistant MFA, monitor for anomalous logins, and alert on new auto-forwarding or mailbox rules.
• Deploy behavioral email security. Use AI that baselines sender and relationship behavior to catch anomalies content filters cannot see.
• Verify high-risk requests out of band. Confirm any change to payment or banking details through a second channel, never by replying to the thread.
• Train employees on thread-level cues. Teach teams to question changed instructions and tone shifts even inside familiar conversations.
• Prepare fast remediation. Ensure you can retract a confirmed threat across every affected mailbox, not one inbox at a time.

How IRONSCALES stops conversation takeover

IRONSCALES detects and stops email conversation takeover by combining behavioral AI, account takeover protection, and automated post-delivery remediation in one API-based platform. Our Adaptive AI builds a behavioral baseline and social graph for every sender using NLP and NLU, so a reply that deviates from an established relationship is flagged even when the content looks clean. When a threat is confirmed, our Themis agentic SOC quarantines it across every affected mailbox in under 30 seconds, containing the fraud everywhere it landed rather than one inbox at a time. IRONSCALES deploys in minutes through native API integration, with no MX record changes and no gateway.

Frequently asked questions

Is conversation hijacking the same as conversation takeover? Yes. Conversation hijacking, email thread hijacking, and thread injection all refer to the same attack: inserting fraudulent messages into a trusted email conversation to deceive the recipient.

How is conversation takeover different from spoofing? Spoofing forges the sender's address, so authentication checks can catch it. Conversation takeover sends from a real, authenticated account inside a real thread, so those checks pass and the message inherits the thread's trust.

Can MFA stop conversation takeover? MFA reduces the account compromise that enables a takeover, but it does not stop the attack on its own. Attackers bypass MFA with adversary-in-the-middle phishing and stolen session tokens, and fabricated-thread attacks need no compromise at all. Behavioral detection and fast remediation are still required.

Related terms

Business email compromise (BEC), account takeover (ATO), vendor email compromise, spear phishing, credential harvesting, adversary-in-the-middle (AiTM).