# Emotet Scales Use of Stolen Email Content for Context-Aware Phishing

> Kryptos Logic reported in April 2019 that Emotet operators harvest the bodies of stolen emails and send automated "RE:" replies containing malicious URLs or weaponized .doc attachments to the original senders and recipients, injecting into legitimate threads to boost credibility. Stolen SMTP credentials and email content are shared across the botnet via a custom Protocol Buffers-based SpamCommand message.

- **Published:** 2026-10-17T18:15:09Z
- **Last reviewed:** 2026-10-17T18:15:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3829
- **ID:** TL-2026-3829
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kryptos Logic's Vantage Team documented an evolution of Emotet's spam operation in which stolen email content is reused to create context-aware phishing. Instead of generic lures, Emotet sends replies (subject lines beginning with "RE:") into existing conversations, addressed to the original participants, containing either a link to a weaponized document or a malicious attachment. Kryptos Logic assessed with moderate confidence that Emotet email collection began in November 2018.

The botnet distributes spam parameters through a custom command protocol built on Google Protocol Buffers (previously described by CERT Polska in 2017). The SpamCommand message wraps two sub-messages: smtp_credentials (server, port, username, password, email_address) and email_templates (from_email, from_name, to_email, to_name, subject, header, body, footer). Kryptos Logic observed stolen SMTP credentials being transmitted unencrypted between botnet members, and noted that credentials are harvested using a password recovery tool published by NirSoft, a legitimate freeware vendor whose utilities are sometimes repurposed by malicious actors.

As of April 10, 2019, roughly 51 unique malicious URLs were being distributed; on April 11, 2019, weaponized .doc attachments began to be sent. Kryptos Logic observed two waves: a higher-value wave targeting the US, Germany, Canada and Japan (including state and local governments) and a more generic wave targeting Mexico and South American countries. Third-party reporting (Trend Micro, Security Affairs citing Malwarebytes) corroborates thread hijacking, reports Emotet delivering secondary payloads such as Nymaim and Nozelesn ransomware, and notes that the share of outbound Emotet emails containing stolen conversations rose from 8.5% in April 2019 to nearly 25% by September 2019.

The source does not publish network IOCs, file hashes, CVEs or actor attribution. Kryptos Logic recommends DKIM and SPF validation on inbound mail servers, and DMARC with correct DKIM/SPF for outbound domain protection. The CVSS score is not applicable; severity is an analyst judgment.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1204.001 Malicious Link
- T1555 Credentials from Password Stores
- T1114.001 Local Email Collection
- T1586.002 Email Accounts
- T1583.006 Web Services

## Sources

- [Emotet Scales Use of Stolen Email Content for Context-Aware Phishing (Kryptos Logic)](https://www.kryptoslogic.com/blog/2019/04/emotet-scales-use-of-stolen-email-content-for-context-aware-phishing/)
- [Further Emotet Evolution: Operators Hijacking Existing Email Threads to Deliver Malware (Trend Micro)](https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/further-emotet-evolution-operators-hijacking-existing-email-threads-to-deliver-malware)
- [Emotet is back, it spreads reusing stolen email content (Security Affairs)](https://securityaffairs.com/91477/malware/emotet-spam-campaign.html)
- [Emotet Returns, Spreads Hijacked Email Conversations (SecurityWeek)](https://securityweek.com/emotet-returns-spreads-hijacked-email-conversations)
- [Emotet Variants Hijack Existing Email Conversations to Distribute Malicious Links (Security Intelligence)](https://securityintelligence.com/news/emotet-variants-hijack-existing-email-conversations-to-distribute-malicious-links)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3829