Report: Rise Of “Conversation-Hijacking” Phishing Attacks Threatens Businesses

Because the technique involves impersonating a trusted employee, the hacking method has the potential to be unusually effective.

There has been a significant increase in the number of hackers implementing “conversation-hijacking” attacks to trick employees into installing malware, transferring money or disclosing their passwords, according to a new report from Barracuda Networks.

The phishing technique involves a hacker infiltrating real email threads between company employees by taking over accounts with previously stolen login credentials, perhaps bought through the dark web, according to ZDNet. After getting into the email account, attackers will impersonate the worker and attempt to extract information from their colleagues.

In an analysis of 500,000 emails, Barracuda found that conversation hijacking increased by over 400 percent between July and November 2019. The attacks are still relatively rare compared to traditional phishing attacks, which typically involve emails asking employees to click a link that installs malware on their devices and allows the attacker to gain access to a network.

But cybersecurity experts are concerned about the attacks because of how effective the technique could potentially be on gaining access to financial accounts or other sensitive information. Hackers will spend time on reading through conversations, researching victims and impersonating the way they write, according to Olesia Klevchuk, senior product manager for email security at Barracuda.

“These attacks are highly personalized, including the content, and therefore a lot more effective,” Klevchuk told ZDNet. “They have the potential of a very large payout, especially when organizations are preparing to make a large payment, purchase or an acquisition.”

Workers are more likely to believe the impersonation than an email from a random address asking them to click a link, according to Klevchuk. But the attacks are also not impossible to spot.

Attackers usually don’t use the actual compromised account to send the phishing message because the actual user can see if an email has been sent from their account. Instead, the hacker will try to impersonate the employee’s email domain with a technique called “typo squatting” that changes one or two characters to trick recipients into thinking the email is the real deal.

This makes it crucial for recipients to check the email address and domain if they are suspicious that their colleague did not send an email demanding account information or payment. In addition, employees should reach out directly to the employee through another contact method -- in person, by phone or through another email -- to check if they sent the email, according to ZDNet.

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.