H1 2026 Attack Chains Bypass Trust

Cybersecurity researchers at Gen Threat Labs have identified two distinct attack methodologies from the first half of 2026 that demonstrate a shift toward exploiting existing trust rather than breaking system defenses. By utilizing legitimate corporate infrastructure and local manipulation, these campaigns bypass traditional perimeter security measures to compromise banking sessions and cryptocurrency transactions.

Exploiting Legitimate Business Mail

In the first identified campaign, attackers targeted users across Czechia, Slovakia, Poland, and Lithuania using hijacked corporate email accounts. Rather than spoofing domains, the threat actors gained unauthorized access to legitimate mailboxes, allowing them to send phishing lures that passed standard authentication protocols like SPF and DKIM.

The emails often mimicked routine business correspondence, such as shipment notifications or invoice alerts. Once a recipient opened the malicious attachment, the attack chain initiated a sequence involving a JavaScript dropper, PowerShell staging, and eventually, the execution of shellcode associated with the GepyS banking malware.

Manipulating Browser Sessions

The banking malware functioned by altering proxy settings and installing unauthorized browser add-ons. By embedding itself directly into the victim’s active banking session, the software could facilitate fraudulent activity without triggering immediate alerts from reputation-based security systems that recognized the originating email account as historically reliable.

This campaign utilized a 32-bit position-independent loader that employed MMX and SSE junk instructions to complicate static analysis. By using a decryption routine based on an LFSR-generated keystream, the attackers added sufficient friction to evade rapid detection during initial security scans.

Hijacking Cryptocurrency Transactions

A second campaign focused on the cryptocurrency sector, utilizing a Rust-compiled clipper to monitor the victim’s clipboard. This malware was designed to identify and replace wallet addresses for 21 different blockchain types, including BTC, ETH, and LTC, with attacker-controlled alternatives.

The threat actors leveraged Binance Smart Chain for command-and-control resolution, a technique known as EtherHiding. By storing infrastructure pointers within smart contracts, the attackers ensured that their backend infrastructure remained accessible even if individual domains or IP addresses were taken down or blocked by security providers.

• Almost 46% of Gen threat detections in the first half of 2026 were scams.
• Malvertising accounted for nearly 30% of total threat detections.
• Gen security systems blocked 114.2 million e-shop scam attacks and 20.3 million tech support scams.

The Mechanics of Trust Abuse

Both attack chains highlight a significant challenge for defenders: the initial interaction often appears legitimate. In the crypto campaign, the user performs a valid transaction signature, but the underlying destination address has been altered locally before the approval step. Because users frequently only verify the first and last few characters of a long, complex wallet address, the modification often goes unnoticed.

The reliance on legitimate infrastructure for delivery and decentralized data for command-and-control means that traditional network-based indicators of compromise (IoCs) become obsolete rapidly. Security teams must now correlate seemingly unrelated events—such as mailbox access, script execution, and proxy modifications—to identify the full scope of a breach.

Implications for Future Defense

The evolution of these attack chains suggests that organizations must prioritize post-delivery telemetry over simple sender authentication. Restricting script interpreters and implementing strict application-control policies can help mitigate the risk of automated staging processes. For cryptocurrency users, the primary defense remains manual verification of the full destination address on the signing device, as automated systems cannot currently distinguish between a user-intended address and a locally hijacked one.