It's one of the most common tactics in use today, primarily because it's so simple and effective.
Trial and error have shown hackers that users are more likely to trust an email if it looks like it's part of an ongoing conversation. So, they often try to spoof that. Unfortunately, spoofing an ongoing conversation is a lot harder to do than it might first seem. As technology has advanced, they've hit on an even better solution.
Instead of spoofing a conversation, why not hijack one?
That's right, hackers now have the capability to hijack a legitimate and ongoing conversation between you and another individual and lace that conversation with malware.
Since the conversation is one the user is currently having naturally, that individual will trust any links or attached files that might be a part of the conversation. That translates into a greater likelihood that those links will be clicked, or those files will be opened.
Right now the main source for this innovative attack variant is the group spreading Qakbot.
Here's how it works:
Qakbot spreads via infected Windows computers. The malware downloads a payload which scans for email accounts. It finds them and steals login credentials while other automated tools are busy going through the user's inbox and sending out phishing emails. They do this by using the "reply all" function when it finds an existing email thread.
The original message is quoted in the reply, which makes it look that much more authentic.
After the original message, the bot will append a few lines of text that contains a request to "look at an attachment" which is often a zip file. Anyone not paying attention is bound to open the file without thinking, and you know the rest of the story.
Keep this one high on your radar, it's particularly sneaky.