Full Report
Gen's H1 2026 Threat Report examines two separate attack chains. One used compromised business inboxes and browser manipulation in a banking-malware campaign, while the other used clipboard hijacking to redirect cryptocurrency payments. [...]
Analysis Summary
# Incident Report: Multi-Vector H1 2026 Campaigns (Banking & Crypto Hijacking)
## Executive Summary
In the first half of 2026, two distinct attack chains targeted legitimate user workflows to facilitate financial theft. The first leveraged compromised corporate email accounts to distribute GepyS banking malware, while the second utilized a Rust-based clipboard hijacker to redirect cryptocurrency payments by manipulating wallet addresses in the system clipboard. Both campaigns successfully bypassed traditional defenses by exploiting trusted communication channels and local user interactions.
## Incident Details
- **Discovery Date:** August 7, 2026 (Report Publication)
- **Incident Date:** H1 2026
- **Affected Organization:** Multiple (Compromised corporate accounts used as relays)
- **Sector:** Logistics, Finance, Professional Services
- **Geography:** Czechia, Slovakia, Poland, Lithuania, and Italy
## Timeline of Events
### Initial Access
- **Date/Time:** Ongoing H1 2026
- **Vector:** Phishing via compromised legitimate business email accounts.
- **Details:** Attackers gained control of corporate mailboxes to send shipment notices and invoices. Because the emails originated from authorized infrastructure, they bypassed SPF/DKIM and reputation-based filters.
### Lateral Movement
- **Banking Chain:** Not explicitly detailed as internal network movement; instead, the malware moved from a JavaScript dropper to PowerShell stages and eventually a shellcode loader.
### Data Exfiltration/Impact
- **Banking Chain:** Modification of browser settings and proxy configurations to intercept banking sessions.
- **Crypto Chain:** Replacement of 21 types of cryptocurrency wallet addresses (BTC, ETH, LTC, etc.) during copy-paste operations to divert funds.
### Detection & Response
- **Detection:** Identified by Gen Threat Labs through telemetry analysis and behavioral monitoring of "clipper" activity and unusual browser add-on installations.
- **Response:** Analysis of the Rust-compiled payloads and de-obfuscation of the GepyS malware stages.
## Attack Methodology
- **Initial Access:** Use of compromised legitimate business email accounts (BEC-assisted distribution).
- **Persistence:** Installation of browser add-ons and modification of proxy settings.
- **Privilege Escalation:** Not specified; standard user-level execution for clipboard manipulation.
- **Defense Evasion:** Use of MMX/SSE junk instructions, jumps into instruction middles, LFSR-generated keystream decryption, and steganography.
- **Credential Access:** Interception of banking credentials via proxy and browser manipulation.
- **Discovery:** Monitoring of system clipboard for strings matching wallet address regex patterns.
- **Lateral Movement:** N/A (Endpoint focused).
- **Collection:** Clipboard monitoring for cryptocurrency addresses.
- **Exfiltration:** Automated redirection of financial transactions to attacker-controlled addresses.
- **Impact:** Financial theft through fraudulent banking sessions and diverted crypto payments.
## Impact Assessment
- **Financial:** High (Direct theft of cryptocurrency and banking funds).
- **Data Breach:** Compromise of banking session data and corporate email credentials.
- **Operational:** Disruption of financial workflows and logistics (via fake invoice/shipment lures).
- **Reputational:** High for organizations whose legitimate mailboxes were used to spread malware to partners.
## Indicators of Compromise
- **Network indicators:**
- C2 infrastructure pointers retrieved from Binance Smart Chain.
- Infrastructure hosted on `Vercel[.]app` and `Blogspot[.]com` (malicious stages).
- **File indicators:**
- Rust-based "Clipper" executables.
- JavaScript droppers and steganographic .NET loaders.
- **Behavioral indicators:**
- Unauthorized changes to system proxy settings.
- Unauthorized installation of browser extensions.
- Modification of clipboard content specifically when hexadecimal strings (wallets) are detected.
## Response Actions
- **Containment:** Gen blocked approximately 114.2 million e-shop scams and 20.3 million tech support lures related to these trends.
- **Eradication:** Removal of malicious browser add-ons and restoration of default proxy settings.
- **Recovery:** Revocation and rotation of credentials for compromised corporate mailboxes.
## Lessons Learned
- **Trust is a Vulnerability:** Traditional email security (SPF/DKIM) is insufficient when the sender's account itself is compromised.
- **Payload Evolution:** Attackers are shifting toward Rust and obfuscated PowerShell to evade static analysis signatures.
- **Workflow Exploitation:** Security must move beyond "broken systems" and address "manipulated workflows" like the clipboard.
## Recommendations
- **MFA Implementation:** Mandatory Multi-Factor Authentication for all corporate mailboxes to prevent account takeover for lure distribution.
- **Clipboard Protection:** Deploy Endpoint Detection and Response (EDR) tools capable of monitoring unauthorized clipboard modifications.
- **Browser Integrity:** Implement policies to restrict the installation of unapproved browser extensions and monitor changes to system proxy settings.
- **User Education:** Train employees to verify cryptocurrency destination addresses on a secondary device or via out-of-band communication before finalizing transactions.