Real emails, hijacked payments: Two H1 2026 attack chains
Gen Threat Labs followed two H1 2026 campaigns where attackers used legitimate accounts, browser settings, and blockchain data as part of the attack path. The campaigns targeted users in Czechia, Slovakia, Poland, and Lithuania, using normal business emails with attachmen…
Intelligence analysis by Llama
Two H1 2026 campaigns used legitimate accounts, browser settings, and blockchain data as part of the attack path. The campaigns targeted users in Czechia, Slovakia, Poland, and Lithuania, using normal business emails with attachments that launched a JavaScript dropper.
Imagine you receive a normal-looking email with an attachment. If you open the attachment, it can launch a program that takes control of your browser and banking session. This is what happened in two recent campaigns where attackers used legitimate accounts and blockchain data to steal money from people's bank accounts. The attackers sent emails that looked like normal business emails, but the attachments contained malicious code that took control of the victim's browser and banking session. The attackers also used a clipboard hijacker to steal cryptocurrency by replacing the victim's wallet address with an attacker-controlled one. This is a clever way to steal money without breaking the victim's wallet or compromising the blockchain.
Analysis
Compromised Corporate Mailboxes and Banking Malware Campaigns
The first campaign targeted users in Czechia, Slovakia, Poland, and Lithuania. The lures looked like normal business emails: shipment notices, invoice-related messages, and scanned document notifications. One simply told the recipient that a scanned copy of a shipment was attached. In several cases, the messages were sent from compromised corporate mailboxes. The email was not made to look like it came from a legitimate company. It came from a legitimate account that attackers had already taken over. SPF and DKIM can still pass when a message is sent through authorized infrastructure, while reputation systems may see a sender with a legitimate history.
The attachment launched a JavaScript dropper. From there, the chain moved through PowerShell stages before reaching shellcode and banking functionality. The available indicators pointed towards GepyS. The malware modified proxy settings and installed a browser add-on, placing itself close to the victim's banking session. At a simplified level, the chain looked like this: compromised mailbox -> JavaScript dropper -> PowerShell stages -> shellcode loader -> proxy and browser manipulation.
One stage-three payload used a 32-bit position-independent loader. Static analysis showed MMX and SSE junk instructions, jumps into the middle of instructions, and a decryption routine based on an LFSR-generated keystream followed by XOR. None of those techniques was new, but together they added enough friction to make a quick static pass less productive. Across the chain, the email only had to get the user to open the attachment. JavaScript and PowerShell handled the staging, the loader slowed analysis, and the proxy and browser changes moved the operation into the banking session.
Comparable H1 campaigns used similar regional and operational patterns with different payloads. In Italy, fake invoice PDFs, including Booking.com-themed lures, led to Vercel-hosted scripts with per-victim JavaScript obfuscation, Blogspot-hosted PowerShell stages, and XWorm. In Poland, invoice-themed phishing delivered a steganographic .NET loader that installed Remcos RAT.
Clipboard Hijacking and Cryptocurrency Malware
The second campaign abused a much smaller user interaction: copying and pasting a cryptocurrency address. The final payload was a Rust-compiled clipboard hijacker. It monitored copied content for wallet addresses across 21 blockchain types, including BTC, ETH, and LTC. When the malware recognized a supported address, it replaced it with an attacker-controlled one. From the victim's point of view, the transaction could still look normal: copy an address, paste it into a wallet or exchange, and approve the payment. The blockchain was not compromised, and the wallet's cryptography was not broken. The transaction itself was valid, but the destination had already been changed locally before signing.
Wallet addresses are long, visually noisy strings, and difficult for humans to verify. Many users check only the first and last few characters, giving attackers room to use replacement addresses that survive a quick glance. The command-and-control design added another layer. The malware used Binance Smart Chain as part of its C2 resolution through EtherHiding. It did not store the full backend on-chain. Instead, it read infrastructure pointers from data stored in a smart contract and used them to reach attacker-controlled infrastructure. The resolved domain, URL, or IP address could be blocked, taken down, or replaced. The smart-contract data remained publicly readable, useful as an investigative pivot and harder to remove through normal takedown processes. A simple network IoC list therefore aged quickly in this setup.
The contract address, the method used to read its data, the returned value, and the infrastructure reached afterwards belonged in the same investigation. Detection has been challenging due to the clipboard hijacker's ability to adapt to different blockchain types and the use of Binance Smart Chain for C2 resolution.
Key points
- Two H1 2026 campaigns used legitimate accounts, browser settings, and blockchain data as part of the attack path.
- The campaigns targeted users in Czechia, Slovakia, Poland, and Lithuania, using normal business emails with attachments that launched a JavaScript dropper.
- The malware modified proxy settings and installed a browser add-on, placing itself close to the victim's banking session.
- The second campaign abused a much smaller user interaction: copying and pasting a cryptocurrency address.
- The final payload was a Rust-compiled clipboard hijacker that monitored copied content for wallet addresses across 21 blockchain types.
- The malware replaced the victim's wallet address with an attacker-controlled one, making it difficult for detection and prevention.
The fact that these campaigns used legitimate accounts and blockchain data to steal money suggests that attackers are becoming more sophisticated in their tactics. However, this also means that there are opportunities for detection and prevention. For example, users can be more cautious when opening attachments from unknown senders, and organizations can implement better security measures to prevent these types of attacks.
The use of clipboard hijackers and Binance Smart Chain for C2 resolution makes it challenging for detection and prevention. Additionally, the fact that the attackers used legitimate accounts and blockchain data to steal money suggests that they have a good understanding of the system and can adapt to different scenarios. This makes it difficult for security measures to keep up with the attackers' tactics.
