TLDR: Attackers exploit email's design and protocols—threading that confers context-based trust and DKIM/DMARC that verify delivery, not identity—to slip payment changes and "quick favors" into real conversations. 2025 data shows thread hijacking in Vendor Email Compromise (VEC) attacks drives high engagement and big losses, amplified by AI-crafted, link-free emails that sail past filters (Darktrace, Aug 5, 2025; Abnormal Security, 2025; IET, Oct 1, 2025).
The quiet flaw: email's UX teaches us to trust the thread
Think about the last dozen emails you answered. Did you verify the sender's full address on every reply in a long thread? Of course not. And that's by design.
Email clients group messages by subject and participants into neat, threaded conversations. This email threading feature is a UX masterpiece that makes chaotic inboxes manageable. It also creates a powerful cognitive shortcut: if a message lives in an ongoing conversation, we assume it belongs. This is context-based trust.
The problem? Once a thread is established, our brains switch from verification mode to conversation mode. We see the familiar sender name, avatar, and preceding messages, and we grant inherited credibility to the reply. We rarely reveal the full header or check the domain because the interface buries those details. As Darktrace notes, this allows attackers to exploit trusted conversations to bypass both technical filters and human suspicion (Darktrace, Thread Hijacking blog). Threading is optimized for recall, not adversarial thinking—making it the perfect vehicle for a scammer to request an invoice edit or "urgent approval."
Protocols aren't people: DKIM/DMARC do integrity, not identity
"But don't we have security protocols for this?" Yes, but they solve a different problem.
DKIM (DomainKeys Identified Mail) provides cryptographic proof that an email hasn't been tampered with and came from an authorized server. But if an attacker registers yourvendor-inc.com instead of yourvendorinc.com, they can set up a perfectly valid DKIM signature for their lookalike domain. The protocol confirms the message is authentically from the wrong domain.
DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving servers what to do with emails that fail these checks. But its effectiveness hinges on perfect configuration and universal adoption. A misconfigured policy or one set to p=none is an open door (Clever Elements; DuoCircle). These limitations explain why attackers using lookalike domains or free webmail—which accounted for 57% of Business Email Compromise (BEC) attacks in 2025—can inject themselves into trusted threads (NatLawReview). The protocol says the email delivered correctly; your brain says it's in the right thread. The trap is set.
How thread hijacking actually plays out in 2025
A modern thread hijacking attack is patient and precise. The sequence:
- Access: Compromise a legitimate account or register a convincing lookalike domain.
- Monitor: Sit quietly inside the compromised inbox—sometimes for weeks—learning rhythm, tone, and key players in financial conversations.
- Insert: At the opportune moment, reply into the existing thread.
- Ask: Make a simple, text-only request. No malicious links. No suspicious attachments. Just plain text asking to change payment details or share a file.
Here's where AI becomes a game-changer. Attackers now use LLMs to generate flawless, context-aware messages that perfectly match a company's tone (Fortra, Conversation Hijacking). Darktrace's mid-year review for 2025 reported detecting over 12.6 million malicious emails in five months, with notable rises in attacks targeting VIPs (Darktrace, Aug 5, 2025).
And it works. According to Abnormal Security, Vendor Email Compromise (VEC) attacks using thread hijacking have a 44% employee engagement rate. In organizations with 50,000+ employees, that jumps to 72%. Between 2024 and 2025, attackers attempted to steal over $300 million this way, yet employees reported only 1.46% of these text-based attacks (Abnormal Security, 2025).
Inside real threads: two scenarios you'll recognize
Scenario A: Vendor "bank details update" in an invoice thread
An attacker, using a domain differing by a single letter, replies to an ongoing invoice conversation. Posing as an accounts receivable specialist, they write: "We are carrying out an account reconciliation audit and our operating account is currently inactive…we are transitioning exclusively to electronic payments…Kindly acknowledge this email so we can send our new banking information."
In a documented 2025 attack, the target replied and looped in colleagues to process payment (Abnormal Security, 2025). The request worked because it inherited thread trust, used a copied signature, and framed urgency as routine operations.
Scenario B: Coworker impersonation in a project thread
Mid-project discussion, a message from a compromised account appears: "Team, quick one—CFO just approved the attached invoice for Project Falcon. Can someone process payment ASAP so we don't delay the vendor?"
The tone is right, timing plausible, leveraging internal hierarchy. Attackers have used AI to forge entire threads with faked executive approvals for urgent payments (Mimecast community, Aug 11, 2025). It exploits the "move fast" culture where a senior colleague's "quick favor" gets immediate response.
Why this keeps working in 2025
Thread hijacking exploits a perfect storm of systemic weaknesses.
Design debt: Email's UX prioritizes conversation flow over identity verification. Context-based trust is the default.
Protocol reality: DKIM and DMARC are guardrails, not identity providers. They can't stop socially-engineered requests from technically "valid" but malicious sources.
Human factors: No links or attachments means bypassing technical filters, placing full burden on employees. With extremely low reporting rates and high engagement in industries like telecommunications (71.3%), the human firewall is often breached (Abnormal Security, 2025).
On October 1, 2025, the Institution of Engineering and Technology warned about surging AI-driven BEC and thread hijacking, calling for stronger verification layers (IET, 2025). The attack surface isn't just a server anymore—it's the conversation itself.
Four checks that don't wreck your day
This isn't about inbox paranoia. It's about deliberate habits for high-stakes requests.
- Payment change? Pause. Any time banking details change within an email thread, stop. Verify out-of-band using a trusted phone number you already had. Don't use contact info from the email.
- Glance at the domain. On payment or data threads, hover over the sender's name. Watch for single-letter swaps or sudden switches to generic providers.
- Treat "urgent" as new. When a colleague or vendor suddenly asks for something unusual and urgent in a long-running thread, confirm via separate channel—chat or call.
- For organizations: Enforce strict
p=rejectDMARC policies, mandate dual-approval for vendor payment changes, and deploy tools detecting behavioral anomalies in email conversations.
The trap is the trust
Email is a social system, not an identity system. Its features preserve context, not truth.
The fix isn't mistrusting every email—it's applying mindful friction to moments that matter. The most effective defense is a simple, reflexive question when an unexpected request arrives from a trusted source in a familiar conversation: "Does this make sense?"
Because in the inbox trust trap, the most dangerous attacks are the ones that feel like business as usual.