Thread hijacking is the abuse of an existing email conversation so a malicious message appears to belong to a trusted chain. Instead of sending a new suspicious email, an attacker replies in a real thread, reuses familiar subject lines, and often keeps the original context, making the message harder to question.
This matters because email trust is built on continuity. If an employee mailbox is compromised, an attacker can read past messages, learn tone and relationships, and then inject convincing requests for payments, credentials, file sharing, or account changes. Defenders look for signs such as unusual reply times, hidden forwarding rules, altered sender addresses, and message-thread changes that do not match normal behavior. Strong MFA, mailbox auditing, phishing-resistant authentication, and careful verification of sensitive requests help reduce the risk.