A wave of reply-chain phishing is hitting internal employee inboxes at IKEA, according to reporting by BleepingComputer. Attackers are hijacking real corporate email threads and replying inside them with malicious links, which makes the bait look almost indistinguishable from normal correspondence.
The IKEA IT team has begun telling staff to ignore the messages and report them for analysis. There is no public confirmation that any internal servers have been compromised, but the campaign is spreading through suppliers and business partners too—multiplying the surface area.
What the attack looks like
This is classic reply-chain phishing, sometimes called thread hijacking. Criminals steal legitimate corporate mail first, then insert themselves into a live conversation. To the recipient, it looks like a coworker, supplier or partner is answering a question they were already part of. That context is the lure.
The delivery chain:
- A reply inside a stolen thread carries a seven-digit link
- Clicking fetches a charts.zip archive
- Inside sits a corrupted Excel file that prompts users to "Enable Content" or "Enable Editing"
- Enabling macros pulls remote OCX files (bestb.ocx, besta.ocx, bestc.ocx) into the C:\Datop folder
- Files register as ActiveX controls via regsvr32.exe
OCX as a delivery format is deprecated in many environments, which is exactly why it slips past older signature-based detection tools. The same delivery pattern has been used historically by Qbot and Emotet-style trojan campaigns—meaning commodity malware operators can now run these plays without custom infrastructure.
Who's at risk and why it spreads
The attack works because it weaponizes trust. A finance team member processing a supplier invoice has no reason to question an attachment from a vendor they spoke with yesterday. That automatic credibility is the point.
| Group | Risk Level | Why |
|---|---|---|
| Finance/procurement | High | Primary targets for invoice and payment thread hijacking |
| IT/security | Medium | Detection depends on fast reporting, not technical controls alone |
| Supplier partners | High | Brand trust gets weaponized without their knowledge |
| End users generally | Medium | High-friction reporting workflows push people toward clicking |
What to watch next
- Whether IKEA or affected vendors confirm any credential or data loss
- Copycat campaigns targeting other large retailers using the charts.zip lure
- Whether endpoint tools start flagging OCX registration via regsvr32.exe more aggressively
How to respond
Bottom line: trust the thread, not the attachment. Shorten the path from "something looks off" to "IT is looking at it." A five-minute triage SLA beats a weekly phishing digest every time.
Key takeaways
- Reply-chain phishing works because it borrows the credibility of a real conversation
- Treat every macro-enabled attachment from a supplier as a ticket for IT, not your inbox
- Cut your internal reporting path to minutes, not days—or staff will quietly start clicking again
- Finance, procurement and anyone handling supplier invoices face the highest exposure
Frequently asked questions
How does the IKEA phishing attack actually work?
Attackers reply inside legitimate internal email threads with links to a charts.zip file. Opening the zip reveals a corrupted Excel document that, when macros are enabled, downloads OCX malware and registers it on the machine.
Has IKEA confirmed a data breach from this campaign?
No. IKEA has warned employees and asked them not to open the messages, but there is no public confirmation that internal servers have been compromised.
Why are attackers using OCX files instead of normal executables?
OCX ActiveX controls are a deprecated format that can slip past older security signatures. Once executed via regsvr32.exe, they install the malware payload without raising alarms on legacy-focused tools.
Which earlier malware families used this same technique?
Campaigns associated with the Qbot and Emotet trojans have used reply-chain phishing and macro-enabled Office documents as delivery vehicles.
What should agile teams do about this kind of attack?
Add a "vendor attachment" check to your Definition of Done, mandate out-of-band confirmation for unexpected files, and make phishing reports a same-hour workflow instead of a weekly digest.