Real emails, hijacked payments: Two H1 2026 attack chains
Gen Digital's latest threat report shows attackers don't need to break trust — they just need to borrow it for a few seconds.
Written by OutOfToken AI
August 10, 2026 · 4 min read · Synthesized from reporting by BleepingComputer · How this works
Gen Digital's H1 2026 Threat Report lays out two attack chains that share almost nothing technically, except the one thing that made both of them work: trust. One rode inside legitimate corporate email accounts to plant banking malware. The other waited for a single copy-paste to swap out a cryptocurrency wallet address.
A mailbox that was never supposed to lie
The first campaign, aimed at users across Central and Eastern Europe, didn't rely on spoofed domains or lookalike senders. It used genuinely compromised corporate mailboxes, according to Gen Threat Labs, which meant messages sailed through SPF and DKIM checks that exist precisely to catch this kind of fraud.
From JavaScript to shellcode
Once opened, the email's payload started as a JavaScript dropper, then escalated through PowerShell stages before executing shellcode on the victim's machine. The end goal wasn't data theft in the abstract — it was the browser itself, with the malware manipulating proxy settings to quietly intercept banking sessions in transit.
The other exploit lived in a keyboard shortcut
The second chain Gen documented needed no inbox at all. Its final payload was a clipboard hijacker compiled in Rust, built to sit quietly and watch for one specific action: a user copying a cryptocurrency wallet address.
"Two campaigns, two payloads, one shared trick: hijacking the moment users stop paying attention — an inbox they trust, a paste they don't double-check."
Copy, paste, redirect
When a victim copied a wallet address to send funds, the hijacker swapped it for one controlled by the attacker before the paste completed. It's a minimal, almost invisible point of failure — no phishing page, no malicious link click at the moment of theft, just a mismatch between what a user copied and what actually got pasted.
Why both chains worked
Neither campaign depended on tricking a user into obviously risky behavior. Gen's report frames both as abuses of routine, trusted workflows — checking a work email, pasting an address to send a payment — rather than exotic technical exploits landing out of nowhere.
Gen Threat Labs positions both cases as evidence that H1 2026's threat landscape is less about breaking security perimeters and more about slipping through the everyday actions those perimeters were never built to scrutinize. As authentication checks and endpoint defenses get better at catching obvious fakes, attackers appear to be betting that the small, mundane moments — an email from a real colleague, a paste before hitting send — will keep paying off.
Editorial Note
The research sources (primarily BleepingComputer's coverage and Source 1's detailed breakdown) corroborate all major technical claims about both attack chains. The article accurately represents Gen Digital's H1 2026 Threat Report findings regarding the compromised email campaign, proxy manipulation, and clipboard hijacking tactics. No contradictions were found between the article's claims and the provided sources.
Claim Tracker
AI-assessed
Source 1 and Source 2 both confirm the JavaScript dropper → PowerShell → shellcode progression in the banking malware campaign
Source 1 explicitly states the banking malware campaign was 'aimed at users across Central and Eastern Europe'
Source 1 confirms that using 'genuinely compromised corporate mailboxes' meant 'messages sailed through SPF and DKIM checks'
Source 1 states the end goal was 'the browser itself, with the malware manipulating proxy settings to quietly intercept banking sessions in transit'
Source 2 confirms 'The final payload was a Rust-compiled clipboard hijacker' that monitored copied cryptocurrency addresses for replacement
Ask AI about this story
// discussion
sign in to join the discussion