cyber.hendryadrian.com
Security Report · cofense.com

Cofense Reports Rising Credential Phishing in Malicious Email Replies

· Original article ↗

Summary

Cofense says credential phishing made up 92.1% of response-themed email reports in Q3 2026. Attackers exploit trusted email threads to deliver phishing pages or malware; the report recommends behavioral email defenses, training, and out-of-band verification.

Key points

  • Response-themed emails place malicious links or payloads in replies to existing legitimate threads or threads initiated by attackers.
  • Attackers may use compromised email accounts or build trust through apparently harmless exchanges before sending a malicious lure.
  • Malware accounted for 83.3% of response-themed ATRs in Q1 2026; credential phishing rose to 62.5% in Q2 and 92.1% in Q3.
  • Examples include meeting invitations delivering GoTo RAT and secure-message lures leading to Microsoft credential phishing or ConnectWise RAT.
  • Cofense warns that sender reputation and trusted-thread signals can miss malicious replies; behavioral analysis of links, attachments, and unusual sender activity may help.
  • Recommendations include realistic awareness exercises, allowlisting remote-access software, password managers, and verifying suspicious requests through contact details obtained independently.

Article Details

Publisher
Cofense
Report Period
Q1 2024–Q3 2026
Scope
Cofense Intelligence's analysis of response-themed email campaigns involving malware delivery and credential phishing.
Key Statistics
  • Malware accounted for 83.3% of response-themed ATRs in Q1 2026.
  • Credential phishing accounted for 62.5% of response-themed ATR volume in Q2 2026.
  • Credential phishing accounted for 92.1% of response-themed ATR volume in Q3 2026.
Recommendations
  • Train employees to recognize malicious replies embedded in existing email threads, and use simulations that reproduce this pattern.
  • Allowlist approved remote access tools and block unapproved tools from installing; where an allowlist is unavailable, block certificates associated with remote access tools the organization does not use.
  • Deploy enterprise password managers to help prevent credential entry on phishing domains.
  • Use email security that analyzes behavioral anomalies in trusted threads, including unusual sender locations and newly introduced links or attachments.
  • Encourage employees to verify suspicious messages out-of-band using contact information obtained independently of the email, and provide a simple way to report suspicious messages.

Vendors

Cofensethat are used to build trust with a potential victim before delivering a malicious threat. While Cofense Intelligence has been tracking these campaigns as response-themed emails, the actual malicious email atConnectWisethe secure message by either accessing a Microsoft account credential phishing site or downloading ConnectWise RAT, a legitimate remote access tool also known as ConnectWise ScreenConnect that is currently one ofLogMeIn, Inc.invitation link that actually delivers GoTo RAT, a legitimate remote access tool that is a part of the LogMeIn management suite and is frequently abused by threat actors as a remote access trojan.Microsoftcenter. However, the site then requests verification to open the secure message by either accessing a Microsoft account credential phishing site or downloading ConnectWise RAT, a legitimate remote access tool also

Products

ConnectWise RATthe secure message by either accessing a Microsoft account credential phishing site or downloading ConnectWise RAT, a legitimate remote access tool also known as ConnectWise ScreenConnect that is currently one of theConnectWise ScreenConnectphishing site or downloading ConnectWise RAT, a legitimate remote access tool also known as ConnectWise ScreenConnect that is currently one of the most frequently abused by threat actors as a remote access trojan.GoTo RATshows a campaign that resulted in a response that sends a meeting invitation link that actually delivers GoTo RAT, a legitimate remote access tool that is a part of the LogMeIn management suite and is frequently abusedTriageUse tools and software provided by Cofense such as Triage and Vision to prevent initial access and stop follow-on attacks. Triage gives security teams an in-depth breakdown of a reported phishing email, which makes aVisionUse tools and software provided by Cofense such as Triage and Vision to prevent initial access and stop follow-on attacks. Triage gives security teams an in-depth breakdown of a reported phishing email, which makes a

Related Articles