In a sophisticated evolution of Business Email Compromise (BEC), attackers are increasingly moving away from direct mailbox access in favor of 'Thread Hijacking 2.0.' This technique, recently highlighted by OSINT reports from small business owners, involves the registration of lookalike domains that closely mimic a target company's legitimate domain. Unlike traditional phishing, where a new, unsolicited email is sent, these attackers insert themselves into ongoing, legitimate conversations. By monitoring public-facing communication or potentially compromising a single peripheral participant's account, the attacker gains visibility into the context, tone, and specific details of a transaction. They then register a domain—for example, 'company-inc.com' instead of 'companyinc.com'—and reply to an existing thread, often including previous messages to maintain the illusion of continuity. This method is particularly effective because it bypasses many traditional security controls. Since the attacker is not sending from the victim's actual mailbox, there are no suspicious logins to detect, no unauthorized forwarding rules to find, and no 'sent items' that would alert the legitimate user. The use of genuine signatures and logos, combined with the psychological weight of an existing conversation, makes these attacks highly successful. In one reported case, a client redirected a significant ACH payment after an attacker replied within a thread, providing 'updated' bank information. The attacker's bank was located in New York, demonstrating that these operations are increasingly domestic and utilize local financial infrastructure to avoid international wire transfer red flags. For defenders, this shift necessitates a move beyond simple MFA (Multi-Factor Authentication) as a silver bullet. Organizations must train employees to scrutinize the 'From' address in every reply, even within a known thread. Furthermore, implementing DMARC (Domain-based Message Authentication, Reporting, and Conformance) and utilizing email security tools that flag 'lookalike' or 'cousin' domains are critical. The success of Thread Hijacking 2.0 underscores a fundamental truth in modern social engineering: context is the ultimate credential. As attackers become more adept at mimicking the nuances of professional communication, the human element remains the most vulnerable, and yet most important, line of defense. This trend is expected to accelerate as LLMs make it easier for attackers to generate perfectly phrased, contextually relevant replies at scale, further blurring the line between legitimate and fraudulent communication.