2 Minute Threat Brief: Free Milk Conversation Hijacking Spear Phishing Campaign
Summary: Unit 42 detailed a spear phishing campaign called FreeMilk that hijacks an in-progress email conversation rather than luring targets with a themed malicious attachment. The campaign exploits a vulnerability in Microsoft Office for which a patch is available, and Unit 42 names board members, C-level executives, military and political personnel, journalists, activists, and those close to them as likely targets.
What's compelling: The attack works because the reply arrives inside a thread the target already trusts, so the usual sender-reputation check never fires - and the Office flaw it leans on already has a patch, meaning unpatched endpoints are the exposure.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026