---
title: This Malware Phishing Campaign Hijacks Email Conversations
description: This Malware Phishing Campaign Hijacks Email Conversations
---

[Securafy Knowledge Hub](https://blog.securafy.com)

- [Topics](https://blog.securafy.com/#sf-cover)
- [Tools](https://blog.securafy.com/#sf-tools)
- [Books & Guides](https://blog.securafy.com/#sf-books)

[Talk to Securafy](https://meetings.hubspot.com/securafy/strategy-call)

[Topics](https://blog.securafy.com/#sf-cover) [Tools](https://blog.securafy.com/#sf-tools) [Books & Guides](https://blog.securafy.com/#sf-books) [Talk to Securafy](https://meetings.hubspot.com/securafy/strategy-call)

[Knowledge Hub](https://blog.securafy.com) / IT Operations

IT Operations

# This Malware Phishing Campaign Hijacks Email Conversations

This Malware Phishing Campaign Hijacks Email Conversations

![Randy Hall](https://blog.securafy.com/hubfs/Randy%20Hall%202.png) By Randy Hall Updated Nov 2025 2 min read Share [**](https://www.linkedin.com/sharing/share-offsite/?url=https://blog.securafy.com/2022/03/28/this-malware-phishing-campaign-hijacks-email-conversations) [**](https://twitter.com/intent/tweet?url=https://blog.securafy.com/2022/03/28/this-malware-phishing-campaign-hijacks-email-conversations&text=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3EThis+Malware+Phishing+Campaign+Hijacks+Email+Conversations%3C%2Fspan%3E) [**](mailto:?subject=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3EThis+Malware+Phishing+Campaign+Hijacks+Email+Conversations%3C%2Fspan%3E&body=https://blog.securafy.com/2022/03/28/this-malware-phishing-campaign-hijacks-email-conversations)

![](https://static.hsstatic.net/BlogImporterAssetsUI/ex/missing-image.png)Hackers have been using social engineering tricks to get their malicious code onto the systems of unsuspecting victims. This has been happening for almost as long as the internet has been around.

It's one of the most common tactics in use today, primarily because it's so simple and effective.

Trial and error have shown hackers that users are more likely to trust an email if it looks like it's part of an ongoing conversation. So, they often try to spoof that. Unfortunately, spoofing an ongoing conversation is a lot harder to do than it might first seem. As technology has advanced, they've hit on an even better solution.

Instead of spoofing a conversation, why not hijack one?

That's right, hackers now have the capability to hijack a legitimate and ongoing conversation between you and another individual and lace that conversation with malware.

Since the conversation is one the user is currently having naturally, that individual will trust any links or attached files that might be a part of the conversation. That translates into a greater likelihood that those links will be clicked, or those files will be opened.

Right now the main source for this innovative attack variant is the group spreading Qakbot.

**Here's how it works:**

Qakbot spreads via infected Windows computers.  The malware downloads a payload which scans for email accounts.  It finds them and steals login credentials while other automated tools are busy going through the user's inbox and sending out phishing emails. They do this by using the "reply all" function when it finds an existing email thread.

The original message is quoted in the reply, which makes it look that much more authentic.

After the original message, the bot will append a few lines of text that contains a request to "look at an attachment" which is often a zip file.  Anyone not paying attention is bound to open the file without thinking, and you know the rest of the story.

Keep this one high on your radar, it's particularly sneaky.

Tagged Under IT Operations[Cybersecurity](https://blog.securafy.com/tag/cybersecurity)Business ContinuityAI Governance

In This Article

Need Help With Your Current Setup?

Talk through your current systems, risks, and support gaps with Securafy.

[Book a Strategy Call](https://meetings.hubspot.com/securafy/strategy-call)

## Join The Conversation

Have a question or perspective on this topic? Add it below.

![Randy Hall](https://blog.securafy.com/hubfs/Randy%20Hall%202.png)

About The Author

Randy Hall · CEO & Founder

Randy Hall is the CEO and Founder of Securafy, with decades of experience helping organizations make smarter, safer decisions about technology.

 A frequent speaker and instructor at national IT events, Randy has advised thousands of organizations, from startups and SMBs to large enterprises and U.S. government entities, on secure, practical technology adoption. He writes about the decisions business leaders are often expected to make without enough context, including cybersecurity, compliance, AI, cyber insurance, IT strategy, and business resilience.

 Outside the office, you’ll often find Randy on Lake Erie enjoying time on his 38-foot Chris-Craft.

**Writes about:** Cybersecurity strategy, compliance, AI security, business resilience, cyber insurance, SMB risk, IT leadership

[More From This Author →](https://blog.securafy.com/author/randyhall)

Related Articles

Business Continuity [Compliance Risk Assessment: How Downtime Impacts Your Bottom Line](https://blog.securafy.com/compliance-risk-assessment-how-downtime-impacts-your-bottom-line)

When systems go down, compliance obligations don't pause—and the financial consequences ...

Jul 28, 2026

Compliance [HIPAA Security Rule Changes Are Delayed To 2027: Why Healthcare Organizations Should Not Wait](https://blog.securafy.com/hipaa-security-rule-changes-are-delayed-to-2027-why-healthcare-organizations-should-not-wait)

The updated HIPAA Security Rule won't take effect until 2027, but healthcare ...

Jul 23, 2026

Compliance [Multi Factor Authentication Best Practices for CJIS Security Policy Compliance](https://blog.securafy.com/multi-factor-authentication-best-practices-for-cjis-security-policy-compliance)

Law enforcement agencies and criminal justice organizations face mounting pressure to ...

Jul 16, 2026

Compliance [CMMC Phase II Has Been Suspended: What Defense Contractors Still Need To Do](https://blog.securafy.com/cmmc-phase-ii-has-been-suspended-what-defense-contractors-still-need-to-do)

The Department of Defense suspended CMMC Phase II enforcement, but that doesn't mean ...

Jul 15, 2026

IT Operations [Cybersecurity For Veterinary Clinics: Protecting Client Data, Payment Systems, And Practice Operations](https://blog.securafy.com/cybersecurity-for-veterinary-clinics-protecting-client-data-payment-systems-and-practice-operations)

Veterinary clinics handle sensitive client data, payment information, and critical ...

Jul 9, 2026

IT Operations [AT&T Cybersecurity, AlienVault USM, And Managed Security: What SMBs Still Need To Own](https://blog.securafy.com/att-cybersecurity-alienvault-usm-and-managed-security-what-smbs-still-need-to-own)

Managed security platforms like AT&T Cybersecurity and AlienVault USM provide ...

Jul 8, 2026

Get Practical Cybersecurity Field Notes

Monthly cybersecurity, compliance, and IT strategy updates from Securafy, written for business owners who need clear next steps.

- Practical security tips from our Cyber Security Drip series
- The Securafy Times, our monthly roundup on compliance and IT strategy
- Occasional updates on new tools, guides, and research
- No spam — unsubscribe anytime

NIST CSF 2.0 Zero Trust Application Control CISA Aligned Enterprise Partner

© 2026 Securafy — Columbus & Cleveland, Ohio

[Main Site](https://www.securafy.com/) [Blog Home](https://blog.securafy.com/) [Contact](https://www.securafy.com/contact.html) [Privacy Policy](https://www.securafy.com/privacy-policy.html)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Randy Hall",
    "url" : "https://blog.securafy.com/author/randyhall"
  },
  "dateModified" : "2025-11-04T19:02:44.393Z",
  "datePublished" : "2022-03-28T15:00:00.000Z",
  "headline" : "This Malware Phishing Campaign Hijacks Email Conversations",
  "mainEntityOfPage" : {
    "@id" : "https://blog.securafy.com/2022/03/28/this-malware-phishing-campaign-hijacks-email-conversations",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.securafy.com/hubfs/securafy-logo.png"
    },
    "name" : "Securafy Inc."
  }
}
```

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://securafy.com/#organization",
  "@type" : "Organization",
  "address" : [ {
    "@type" : "PostalAddress",
    "addressLocality" : "Columbus",
    "addressRegion" : "OH",
    "postalCode" : "43219",
    "streetAddress" : "4449 Easton Way, Suite 200"
  }, {
    "@type" : "PostalAddress",
    "addressLocality" : "Independence",
    "addressRegion" : "OH",
    "postalCode" : "44131",
    "streetAddress" : "6100 Oak Tree Blvd, Suite 200"
  } ],
  "areaServed" : [ "Columbus OH", "Cleveland OH", "Ohio" ],
  "name" : "Securafy Inc.",
  "url" : "https://securafy.com/"
}
```

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://securafy.com/#website",
  "@type" : "WebSite",
  "inLanguage" : "en-US",
  "name" : "Securafy",
  "publisher" : {
    "@id" : "https://securafy.com/#organization"
  },
  "url" : "https://securafy.com/"
}
```

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://blog.securafy.com/#blog",
  "@type" : "Blog",
  "name" : "Securafy Knowledge Hub",
  "publisher" : {
    "@id" : "https://securafy.com/#organization"
  },
  "url" : "https://blog.securafy.com"
}
```

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://blog.securafy.com/2022/03/28/this-malware-phishing-campaign-hijacks-email-conversations#article",
  "@type" : "Article",
  "author" : {
    "@id" : "https://www.securafy.com/about-us/#randyhall",
    "@type" : "Person",
    "name" : "Randy Hall"
  },
  "dateModified" : "2025-11-04T19:02:44+00:00",
  "datePublished" : "2022-03-28T15:00:00+00:00",
  "description" : "This Malware Phishing Campaign Hijacks Email Conversations",
  "headline" : "This Malware Phishing Campaign Hijacks Email Conversations",
  "image" : "https://www.securafy.com/hs-fs/hubfs/securafy-og-default.jpg",
  "inLanguage" : "en-US",
  "isPartOf" : {
    "@id" : "https://blog.securafy.com/#blog"
  },
  "mainEntityOfPage" : {
    "@id" : "https://blog.securafy.com/2022/03/28/this-malware-phishing-campaign-hijacks-email-conversations",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@id" : "https://securafy.com/#organization"
  },
  "url" : "https://blog.securafy.com/2022/03/28/this-malware-phishing-campaign-hijacks-email-conversations"
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "BreadcrumbList",
  "itemListElement" : [ {
    "@type" : "ListItem",
    "item" : "https://blog.securafy.com",
    "name" : "Knowledge Hub",
    "position" : 1
  }, {
    "@type" : "ListItem",
    "item" : "https://blog.securafy.com/2022/03/28/this-malware-phishing-campaign-hijacks-email-conversations",
    "name" : "This Malware Phishing Campaign Hijacks Email Conversations",
    "position" : 2
  } ]
}
```