# Response-Themed Email Thread Hijacking Delivers GoTo RAT, ConnectWise RAT and Credential Phishing

> Cofense Intelligence reports threat actors placing malware and credential phishing at the end of email threads, either replying inside existing threads from compromised accounts or starting new, seemingly harmless threads to build trust first. Observed payloads include GoTo RAT (LogMeIn remote access tooling) and ConnectWise RAT (ScreenConnect abused as a remote access trojan), plus Microsoft-spoofing credential phishing pages.

- **Published:** 2026-10-22T04:35:49Z
- **Last reviewed:** 2026-10-22T04:35:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4107
- **ID:** TL-2026-4107
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cofense Intelligence's strategic analysis (published 2026-10-21) describes response-themed email campaigns in which the malicious content is delivered at the end of a long email thread, designed to exploit the recipient's trust in an email contact. Two techniques are described: replying within an existing thread (consistent with use of a compromised mailbox) and starting a new, seemingly harmless thread that builds rapport before the payload message is sent.

The final message in the thread carries one of three lures: a meeting invitation link, a secure message notification, or a document/file sharing request. Payloads are either legitimate remote access tools repurposed as remote access trojans - GoTo RAT (a LogMeIn-based remote access tool) and ConnectWise RAT (ConnectWise ScreenConnect) - or credential phishing sites, particularly pages spoofing Microsoft. Two Cofense Active Threat Reports are cited as examples: ATR 416570 (meeting invitation delivering GoTo RAT) and ATR 418145 (secure message notification delivering either credential phishing or ConnectWise RAT).

Cofense reports the payload mix shifted during 2026: 83.3% of thread-based attacks in Q1 2026 were malware-focused, while credential phishing dominated in Q2 (62.5%) and Q3 (92.1%). Volumes were similar to Q1 2024, declined through late 2024 and 2025, and resurged in 2026. The report names no threat actor, sectors, or specific IOCs (no domains, IPs, hashes, URLs or filenames), and no CVE is involved. Severity is an analyst estimate.

Separate Cofense research (2025-05-21) documents that ConnectWise ScreenConnect accounted for 56% of all ATRs involving legitimate remote access tools in 2024, abused via its 14-day trial and a permanent free tier limited to 3 agents. ScreenConnect agents use a default relay port of 8041, and the client service command line embeds relay host (h) and port (p) parameters, which are useful hunting artifacts. Because the campaign uses legitimate signed tooling and replies from real mailboxes, SPF/DKIM/DMARC checks and reputation-based controls may pass.

## MITRE ATT&CK

- T1586.002 Email Accounts
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1534 Internal Spearphishing
- T1219 Remote Access Tools
- T1219.002 Remote Access Tools: Remote Desktop Software

## Sources

- [Threats Hidden in Replies: Threat Actors Deliver Malware and Credential Phishing in Email Threads](https://cofense.com/blog/cofense-intelligence-strategic-analysis)
- [New Weapon of Choice - How Threat Actors Hijack Legitimate Remote Access Tools](https://cofense.com/blog/new-weapon-of-choice-how-threat-actors-hijack-legitimate-remote-access-tools)
- [LinkedIn InMail Spoofing Malware Campaign Unleashes ConnectWise RAT](https://www.esecurityplanet.com/ja/cybersecurity/linkedin-inmail-spoofing-connectwise-rat-threat/)
- [Thread Hijacking: How Attackers Exploit Trusted Conversations to Infiltrate Networks](https://www.darktrace.com/es/blog/thread-hijacking-how-attackers-exploit-trusted-conversations-to-infiltrate-networks)
- [What is Thread Hijacking](https://abnormal.ai/learning/what-is-thread-hijacking)
- [Email Conversation Takeover: How to Detect Thread Hijacking After Account Compromise](https://ironscales.com/blog/how-to-detect-email-conversation-takeover)
- [ScreenConnect Attack](https://www.forcepoint.com/x-labs/screenconnect-attack)
- [Hackers Increasingly Abuse Legitimate Remote Access Tools Like ConnectWise in 2025](https://www.thaicert.or.th/en/2025/05/27/hackers-increasingly-abuse-legitimate-remote-access-tools-like-connectwise-in-2025/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4107