Threat reportPhishingTL-2026-4107
Response-Themed Email Thread Hijacking Delivers GoTo RAT, ConnectWise RAT and Credential Phishing
Response-Themed Email Thread Hijacking Delivers GoTo RAT (TL-2026-4107), also tracked as Email thread hijacking, is a medium-severity phishing campaign, first published 2026-10-22. It has no confirmed attribution, affects ConnectWise ScreenConnect (abused legitimate remote access tool, not a, maps to 7 MITRE ATT&CK techniques (T1204.001, T1219, T1219.002), and is covered by 9 detection rules and 7 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4107
- Threat ID
- TL-2026-4107
- Also known as
- Email thread hijacking, Reply-chain phishing, Conversation hijacking
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in Response-Themed Email Thread Hijacking Delivers GoTo RAT
Malware and tooling: ConnectWise RAT, GoTo RAT, ConnectWise ScreenConnect, LogMeIn, LogMeIn Resolve, ScreenConnect
How Response-Themed Email Thread Hijacking Delivers GoTo RAT works
Cofense Intelligence reports threat actors placing malware and credential phishing at the end of email threads, either replying inside existing threads from compromised accounts or starting new, seemingly harmless threads to build trust first. Observed payloads include GoTo RAT (LogMeIn remote access tooling) and ConnectWise RAT (ScreenConnect abused as a remote access trojan), plus Microsoft-spoofing credential phishing pages.
Cofense Intelligence's strategic analysis (published 2026-10-21) describes response-themed email campaigns in which the malicious content is delivered at the end of a long email thread, designed to exploit the recipient's trust in an email contact. Two techniques are described: replying within an existing thread (consistent with use of a compromised mailbox) and starting a new, seemingly harmless thread that builds rapport before the payload message is sent.
The final message in the thread carries one of three lures: a meeting invitation link, a secure message notification, or a document/file sharing request. Payloads are either legitimate remote access tools repurposed as remote access trojans - GoTo RAT (a LogMeIn-based remote access tool) and ConnectWise RAT (ConnectWise ScreenConnect) - or credential phishing sites, particularly pages spoofing Microsoft. Two Cofense Active Threat Reports are cited as examples: ATR 416570 (meeting invitation delivering GoTo RAT) and ATR 418145 (secure message notification delivering either credential phishing or ConnectWise RAT).
Cofense reports the payload mix shifted during 2026: 83.3% of thread-based attacks in Q1 2026 were malware-focused, while credential phishing dominated in Q2 (62.5%) and Q3 (92.1%). Volumes were similar to Q1 2024, declined through late 2024 and 2025, and resurged in 2026. The report names no threat actor, sectors, or specific IOCs (no domains, IPs, hashes, URLs or filenames), and no CVE is involved. Severity is an analyst estimate.
Separate Cofense research (2025-05-21) documents that ConnectWise ScreenConnect accounted for 56% of all ATRs involving legitimate remote access tools in 2024, abused via its 14-day trial and a permanent free tier limited to 3 agents. ScreenConnect agents use a default relay port of 8041, and the client service command line embeds relay host (h) and port (p) parameters, which are useful hunting artifacts. Because the campaign uses legitimate signed tooling and replies from real mailboxes, SPF/DKIM/DMARC checks and reputation-based controls may pass.
MITRE ATT&CK techniques used in TL-2026-4107
Execution
Command and Control
T1219 Remote Access Tools; T1219.002 Remote Access Tools: Remote Desktop Software
Lateral Movement
Initial Access
Resource Development
Defense Evasion
Affected products and versions in Response-Themed Email Thread Hijacking Delivers GoTo RAT
- ConnectWise — ScreenConnect (abused legitimate remote access tool, not a vulnerability)
- GoTo / LogMeIn — LogMeIn remote access tooling (abused as GoTo RAT, not a vulnerability)
- Microsoft — Microsoft account / Microsoft 365 sign-in (spoofed by credential phishing pages)
Remediation for Response-Themed Email Thread Hijacking Delivers GoTo RAT
Immediate actions
- Hunt for ScreenConnect.ClientService.exe or GoTo/LogMeIn Resolve agents installed outside of IT-approved deployment and review their relay hosts
- Alert on outbound TCP/8041 and on ScreenConnect/GoTo agents not tied to a sanctioned instance
- Review mailboxes sending unexpected replies in existing threads containing meeting invite, secure message or file share links; reset credentials and revoke sessions for any compromised account
- Search mail logs for the lure patterns (meeting invitation, secure message notification, document share) appearing late in long threads
Workarounds
- Block downloads of .exe and .msi installers from newly seen domains at the web proxy
- Restrict outbound access to unsanctioned remote access relay infrastructure
Longer-term hardening
- Allowlist approved remote access tools and block installation or execution of all others via application control
- Deploy conversation-aware email security that evaluates replies in context rather than per message
- Enforce phishing-resistant MFA and conditional access to limit mailbox takeover
- Train users to verify unexpected meeting, secure message and file share links in threads out-of-band
Timeline of Response-Themed Email Thread Hijacking Delivers GoTo RAT
- Q1 2024: Cofense observes thread-based malware and phishing delivery at volumes similar to those seen again in 2026 (date approximates the quarter).
- Through 2024, ConnectWise ScreenConnect accounts for 56% of Cofense ATRs involving legitimate remote access tools (Cofense, published 2025-05-21).
- Cofense publishes 'New Weapon of Choice' documenting abuse of ScreenConnect, Atera/Splashtop, FleetDeck, LogMeIn Resolve and other legitimate remote access tools, including ScreenConnect port 8041 and h/p parameters.
- Q1 2026: 83.3% of thread-based attacks observed by Cofense are malware-focused (date approximates the quarter).
- Q2 2026: credential phishing becomes dominant at 62.5% of thread-based attacks (date approximates the quarter).
- Q3 2026: credential phishing reaches 92.1% of thread-based attacks (date approximates the quarter).
- Cofense Intelligence publishes 'Threats Hidden in Replies', citing ATR 416570 (meeting invitation delivering GoTo RAT) and ATR 418145 (secure message notification delivering phishing or ConnectWise RAT).
Sources cited for Response-Themed Email Thread Hijacking Delivers GoTo RAT
- Threats Hidden in Replies: Threat Actors Deliver Malware and Credential Phishing in Email Threads
- New Weapon of Choice - How Threat Actors Hijack Legitimate Remote Access Tools
- LinkedIn InMail Spoofing Malware Campaign Unleashes ConnectWise RAT
- Thread Hijacking: How Attackers Exploit Trusted Conversations to Infiltrate Networks
- What is Thread Hijacking
- Email Conversation Takeover: How to Detect Thread Hijacking After Account Compromise
- ScreenConnect Attack
- Hackers Increasingly Abuse Legitimate Remote Access Tools Like ConnectWise in 2025
Detection coverage for TL-2026-4107
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4107 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.