Threat Brief: Conversation Hijacking Spear Phishing
Summary: Unit 42 described a spear phishing campaign, dubbed FreeMilk, in which an attacker takes over one party's email account, most likely through credential theft, and uses an in-progress conversation with a second party to send a malicious email that appears to belong to that thread. The specific attack observed relied on a vulnerability in Microsoft Office for which a patch was available, and the researchers said a patched target would not be compromised.
Why it matters: The technique makes a malicious email nearly indistinguishable from a legitimate one, so the researchers place protection in patching and layered controls rather than user detection. They name board members, CEOs, CFOs, CSOs, journalists, activists and executive assistants as the people who could face it, and note an assistant can be the entry point to reach a CEO.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026