Threat reportMalwareTL-2026-3829
Emotet Scales Use of Stolen Email Content for Context-Aware Phishing
Emotet Scales Use of Stolen Email Content for Context-Aware (TL-2026-3829), also tracked as Emotet thread hijacking, is a high-severity malware campaign, first published 2026-10-17. It has no confirmed attribution, affects Various Email users and organizations (Microsoft Windows endpoints, maps to 8 MITRE ATT&CK techniques (T1114.001, T1204.001, T1204.002), and is covered by 9 detection rules and 8 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3829
- Threat ID
- TL-2026-3829
- Also known as
- Emotet thread hijacking, Emotet context-aware phishing
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- government administration, state and local government, enterprise
- Target regions
- united states of america, germany, canada, japan, mexico, 005 - South America
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in Emotet Scales Use of Stolen Email Content for Context-Aware
Malware and tooling: Emotet - S0367, Nozelesn, Nymaim, Ursnif - S0386, Emotet custom Protocol Buffers C2 protocol, NirSoft password recovery tool
How Emotet Scales Use of Stolen Email Content for Context-Aware works
Kryptos Logic reported in April 2019 that Emotet operators harvest the bodies of stolen emails and send automated "RE:" replies containing malicious URLs or weaponized .doc attachments to the original senders and recipients, injecting into legitimate threads to boost credibility. Stolen SMTP credentials and email content are shared across the botnet via a custom Protocol Buffers-based SpamCommand message.
Kryptos Logic's Vantage Team documented an evolution of Emotet's spam operation in which stolen email content is reused to create context-aware phishing. Instead of generic lures, Emotet sends replies (subject lines beginning with "RE:") into existing conversations, addressed to the original participants, containing either a link to a weaponized document or a malicious attachment. Kryptos Logic assessed with moderate confidence that Emotet email collection began in November 2018.
The botnet distributes spam parameters through a custom command protocol built on Google Protocol Buffers (previously described by CERT Polska in 2017). The SpamCommand message wraps two sub-messages: smtp_credentials (server, port, username, password, email_address) and email_templates (from_email, from_name, to_email, to_name, subject, header, body, footer). Kryptos Logic observed stolen SMTP credentials being transmitted unencrypted between botnet members, and noted that credentials are harvested using a password recovery tool published by NirSoft, a legitimate freeware vendor whose utilities are sometimes repurposed by malicious actors.
As of April 10, 2019, roughly 51 unique malicious URLs were being distributed; on April 11, 2019, weaponized .doc attachments began to be sent. Kryptos Logic observed two waves: a higher-value wave targeting the US, Germany, Canada and Japan (including state and local governments) and a more generic wave targeting Mexico and South American countries. Third-party reporting (Trend Micro, Security Affairs citing Malwarebytes) corroborates thread hijacking, reports Emotet delivering secondary payloads such as Nymaim and Nozelesn ransomware, and notes that the share of outbound Emotet emails containing stolen conversations rose from 8.5% in April 2019 to nearly 25% by September 2019.
The source does not publish network IOCs, file hashes, CVEs or actor attribution. Kryptos Logic recommends DKIM and SPF validation on inbound mail servers, and DMARC with correct DKIM/SPF for outbound domain protection. The CVSS score is not applicable; severity is an analyst judgment.
MITRE ATT&CK techniques used in TL-2026-3829
Collection
T1114.001 Local Email Collection
Execution
T1204.001 Malicious Link; T1204.002 Malicious File
Credential Access
T1555 Credentials from Password Stores
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Resource Development
Affected products and versions in Emotet Scales Use of Stolen Email Content for Context-Aware
- Various — Email users and organizations (Microsoft Windows endpoints receiving Emotet lures)
Remediation for Emotet Scales Use of Stolen Email Content for Context-Aware
Immediate actions
- Enable DKIM and SPF validation on inbound mail servers
- Block or quarantine inbound email linking to or attaching weaponized Office documents from unverified senders
- Reset credentials and review mailbox rules for any account whose SMTP credentials or email content may have been exposed
- Alert users to unexpected "RE:" replies in existing threads that carry links or attachments
Workarounds
- Treat context or timing anomalies in thread replies as suspicious even when the sender and thread appear legitimate
Longer-term hardening
- Publish DMARC with correctly implemented DKIM and SPF for outbound domains to limit spoofing of your domain
- Detect use of password-recovery utilities (e.g. NirSoft tools) on endpoints
- Consider Managed Detection and Response (MDR) for email-borne threat analysis
Timeline of Emotet Scales Use of Stolen Email Content for Context-Aware
- Emotet originally discovered (per Trend Micro, 2014; exact date not stated).
- CERT Polska documents Emotet's custom Protocol Buffers-based communication protocol (2017; exact date not stated).
- Kryptos Logic assesses with moderate confidence that Emotet email collection began around November 2018.
- Cofense reportedly first detects hijack attacks using stolen emails (per SecurityWeek/Security Intelligence coverage).
- Approximately 51 unique malicious URLs observed being distributed in context-aware phishing emails.
- Weaponized .doc files begin being attached to the thread-injected emails.
- Kryptos Logic publishes analysis of Emotet's reuse of stolen email content, the SpamCommand protocol and NirSoft-based SMTP credential theft; Trend Micro reports the same day.
- Campaign resurges; nearly 25% of outbound Emotet emails reportedly include stolen conversations, up from 8.5% in April 2019 (Security Affairs).
Sources cited for Emotet Scales Use of Stolen Email Content for Context-Aware
- Emotet Scales Use of Stolen Email Content for Context-Aware Phishing (Kryptos Logic)
- Further Emotet Evolution: Operators Hijacking Existing Email Threads to Deliver Malware (Trend Micro)
- Emotet is back, it spreads reusing stolen email content (Security Affairs)
- Emotet Returns, Spreads Hijacked Email Conversations (SecurityWeek)
- Emotet Variants Hijack Existing Email Conversations to Distribute Malicious Links (Security Intelligence)
Detection coverage for TL-2026-3829
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3829 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.