It seems that a new trend has emerged in the past few weeks. While users are (meanwhile) aware that an unexpected mail with subject "Your invoice" or "Your delivery" is suspicious, it seems that nowadays such attempts more often (in fact, according to my observations: massively) use specific subject lines that match some mail conversations of the past (e.g., "Re: Suggested changes to sales contract Samplestreet" when contract negotiations about estate in Samplestreet really were a thing the attacked recipient was involved with). Of course, such a subject line gives the recipient a false sense of trust and may make them open malicious attachments.

Apparently, some machine was infected where the malware harvested subject-recipient pairs (and as of now, I doubt that it happened here).

Apart from telling my users in general to be even more cautious than usual, what are suitable measures against this form of attack? (To begin with: Does it have a specific name that helps me find information about it? While being more specific than phishing, this is still less specific than spear phishing, I guess)

Practically the only thing that comes to my mind is to inform all external parties involved (in the Samplestreet deal, say) that they may have been infected. And also warn involved internal users that they may receive more such attacks in this matter in their department.


This is not new over a few weeks. I have been dealing with these across dozens of orgs since October 2019. The account is compromised, and a reply is made to an existing email thread.

What is common to all of the ones I have seen is that they include a button (or link) that is supposed to allow the user to access encrypted content or "the rest" of the content. It's the button (or link) that's the threat and it is the code that allows for the compromise.

This button has a name: RGB Button

In one org I look after, I had done a wave of special awareness campaigns and special messages on RGB. But the CFO in one org clicked the button and their account was compromised. When I sat down with him to hear his story, he said that he had been corresponding with a supplier, who told him that they would send documents shortly. 20 minutes later, the RGB Button email came through. Without any need for suspicion, and since many vendors use special file hosting services, he clicked the button. It was perfectly reasonable for him to do so in that context.

The subject line is just a factor to reduce the target's resistance. The threat is in the email body or the attachment, and that's not new. So don't focus on the subject line, focus on the threat and focus on supporting your users when it's perfectly reasonable for them to interact with a phishing email.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.