“Scams accounted for almost 46% of Gen threat detections in the first half of the year.” That single statistic, reported by Gen Threat Labs in its H1 2026 Threat Report, frames two campaign investigations that show how attackers are riding inside legitimate workflows to turn routine trust into a point of failure.
How the banking chain unfolded
Gen Threat Labs traced a regional banking-malware campaign that began with messages sent to recipients in Czechia, Slovakia, Poland and Lithuania. The lures were ordinary business correspondence — shipment notices, invoice prompts and scanned-document notifications — and in multiple cases the messages were sent from compromised corporate mailboxes. The emails did not impersonate a company; they arrived from accounts attackers had already taken over, and SPF/DKIM could still pass because the mail used authorized infrastructure.
Opening an attachment launched a JavaScript dropper that handed off to PowerShell stages, which delivered shellcode and banking functionality. The chain modified proxy settings and installed a browser add-on, positioning the malware directly inside a victim’s banking session. One stage-three payload was a 32‑bit position‑independent loader containing MMX and SSE “junk” instructions, jumps into mid‑instruction, and a decryption routine using an LFSR‑generated keystream followed by XOR — techniques that increased analysis friction. Gen’s attribution pointers in this activity led toward GepyS.
The clipboard hijacker and Binance Smart Chain C2
The second campaign reduced the human step to a single copy-and-paste. A Rust‑compiled clipboard hijacker monitored copied content for wallet addresses across 21 blockchains (including BTC, ETH and LTC) and, when it saw a supported address, silently replaced it with an attacker-controlled destination. The blockchain itself was untouched and cryptography was not broken: the transaction signed by the user remained valid, but the recipient had already been changed locally.
The malware’s command-and-control design relied on Binance Smart Chain using an approach Gen describes as EtherHiding. Instead of hard-coding a backend on-chain, the malware read infrastructure pointers from data stored in a smart contract, then used those pointers to reach attacker-controlled domains, URLs or IPs. That design makes simple network IoC lists age quickly while leaving a public, investigable trail in the smart-contract data.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWhy single IoCs and reputation fail in these chains
Both campaigns exploited trusted elements rather than breaking cryptography or core protocols. In the banking chain the delivery vector was a genuinely trusted mailbox; in the crypto campaign the user’s signing workflow and the public blockchain both remained intact. Because attackers used legitimate mail infrastructure and on-chain pointers, reputation signals and stand‑alone IoCs (a sender domain, a single C2 domain, a file hash) can understate risk or become obsolete.
Gen highlights that the smart contract address, the method used to read its data, the returned pointer and the final infrastructure reached should be treated as a linked indicator set — not isolated artifacts. Likewise, the sender’s legitimate history should not lower the priority of post-delivery behaviors that indicate a mailbox takeover.
Detection and mitigation guidance for defenders
Gen’s analysis emphasizes sequence-aware detection. For the banking chain, pairing sender authentication with post‑delivery telemetry is critical: an attachment that spawns JavaScript, PowerShell downloading stages, shellcode execution, proxy reconfiguration and a new browser extension should be correlated as a single malicious sequence. Where operationally feasible, organizations can restrict script interpreters for users who do not need them, apply application‑control policies to downloaded attachments, and alert on unexpected proxy or browser‑extension changes.
For the clipboard hijacker, defenders should monitor clipboard‑modifying processes, wallet‑address pattern matching, and blockchain queries originating from applications that have no business querying ledgers. Track the smart‑contract pointer and the infrastructure it resolves together; a takedown of the resolved domain will not erase the on‑chain pointer data that investigators can read publicly.
What this means for technologists, enterprises, and end users
- Technologists and security teams: prioritize telemetry that links delivery to post‑delivery actions (attachment→scripting→proxy/extension changes) and add behavioral monitors for clipboard tampering and unexpected blockchain queries.
- Affected enterprises and procurement leaders: assume that a sender’s legitimate history is not a guarantee — limit scripting where possible, enforce application control on attachments, and treat mailbox telemetry as part of detection, not merely a delivery signal.
- End users and the general public: verify the full destination shown by a signing device or wallet immediately before approval; prefer address books or allowlists and treat first‑time or changed destinations as deserving a full comparison rather than a glance at starting and ending characters.
Gen Threat Labs’ H1 2026 findings underline a practical lesson: attackers will exploit the mundane — a copied address, a trusted mailbox, a browser extension — and use legitimate systems as part of their attack surface. Detection that follows the sequence of actions and verification that covers the steps between an authenticated email or a copied value and the final approved action are the defenses that best match these evolving tactics.
