Reply-gated phishing is a social-engineering technique where the attacker sends an apparently harmless message first and delivers the malicious content only after the target replies. The initial email or chat may look routine, such as a request for information or a follow-up question, but the real payload is withheld until the attacker confirms engagement.
This matters because it turns the conversation itself into part of the attack. A reply can create trust, bypass filters that only score the first message, and make the next email look like a normal thread continuation. In real attacks, the follow-up may include a malicious attachment, a download link, or instructions that lead to malware installation. Defenders should inspect thread changes, unexpected file-sharing requests, and new links or attachments appearing after a reply. Mail security, user verification, and endpoint detection are important because the danger often begins after the conversation starts, not when the first message arrives.