Gen H1 2026: Hijacked Business Inboxes Deliver Malware

The shipment notice was real. The supplier was real. The mailbox that sent it was real, which is why SPF and DKIM passed honestly and nothing in the header told the recipient anything was wrong. That is the uncomfortable center of Gen Digital's H1 2026 Threat Report: the two attack chains it dissects in detail do not begin with a spoofed domain or a lookalike sender. They begin with a mailbox that already belonged to somebody the victim does business with.

Key Takeaways

• Gen Digital's H1 2026 Threat Report documents a banking malware campaign across Czechia, Slovakia, Poland and Lithuania that spread from compromised corporate mailboxes using shipment notice, invoice and scanned document lures.
• Because the sending accounts were legitimate and already compromised, the phishing messages passed SPF and DKIM authentication rather than failing it.
• A second chain ended in a Rust compiled clipboard hijacker that monitored copied wallet addresses across 21 blockchains, including BTC, ETH and LTC, and swapped them for attacker controlled addresses before the victim pasted.
• Scams made up nearly 46% of all Gen threat detections in H1 2026, with 114.2 million e-shop scam attacks and 20.3 million tech support scam attacks blocked.
• Related regional campaigns delivered XWorm through Booking.com themed invoice PDFs in Italy and Remcos RAT through a steganographic .NET loader in Poland.

What Did the Banking Malware Chain Actually Do?

It walked a victim from a routine business email all the way into a manipulated browser sitting on top of a live banking session. Gen's H1 2026 Threat Report traces the sequence as a JavaScript dropper, then PowerShell stages, then a shellcode loader, and finally proxy manipulation plus browser extension installation. The suspected payload is tracked as GepyS, and the loader used MMX and SSE junk instructions along with LFSR based encryption to frustrate analysis.

Notice where the chain ends. Not at credential theft, not at a fake login page, but at the browser itself, positioned as close to the victim's banking session as the attacker can get. Once a proxy configuration and a malicious extension are in place, the attacker does not need to guess a password or intercept a one time code. The victim authenticates normally, and the manipulation happens on the page they trust.

The geography is Central and Eastern Europe: Czechia, Slovakia, Poland and Lithuania. That regional focus is a targeting choice, not a technical constraint. Every component in the chain, from the JavaScript dropper to the browser extension install, is portable to any language and any bank.

Why Did the Phishing Emails Pass Authentication?

Because the emails were not forged. Gen reports that the messages originated from legitimate compromised accounts, which means SPF and DKIM evaluated genuine sending infrastructure and returned genuine passes. There was nothing for authentication to catch.

This is the structural limit of email authentication, and it is worth stating plainly because a lot of security guidance implies otherwise. RFC 7489, which defines DMARC, is a domain authentication mechanism. It answers whether a message really came from the domain it claims. It has no opinion at all about whether the human behind that domain is still the person who owns the account. Compromise the mailbox and the entire stack works perfectly on the attacker's behalf.

The lures matched the channel. Shipment notices, invoices and scanned document notifications are the three highest volume categories of routine business mail, which makes them the three categories an employee is least likely to scrutinize. In Italy, fake invoice PDFs including Booking.com themed lures led to Vercel hosted scripts with per victim JavaScript obfuscation, ending in XWorm. In Poland, invoice themed phishing delivered a steganographic .NET loader that installed Remcos RAT, a commodity remote access tool that we saw used in the same period through a fake COLDCARD security audit email. Different regions, different payloads, one delivery pattern.

How Does a Clipboard Hijacker Steal a Payment?

It waits for you to copy a wallet address and hands you a different one. The second chain in Gen's report runs four stages and ends in a Rust compiled multi coin clipboard monitor watching for address formats across 21 blockchains, Bitcoin, Ethereum and Litecoin among them. The substitution happens between copy and paste. The transaction the victim then signs is entirely valid. It simply goes somewhere else.

Nobody proofreads a 42 character hexadecimal string. That is the whole exploit. There is no credential theft, no session token, no exploit of a software flaw at the moment of theft, just an assumption that what you pasted is what you copied.

The command and control design deserves attention from anyone doing takedown work. The operators used EtherHiding on Binance Smart Chain, storing C2 pointers inside smart contracts. A hosting provider can pull a server. Nobody can pull a smart contract off a public blockchain. The Ethereum documentation on smart contract immutability describes the property the attackers are relying on, and it was designed as a feature.

What This Means for Your Inbox

Both chains treat the inbox as the trusted ground floor of the attack, and both work because inbound business mail from a known contact gets a level of trust that no other channel receives. An employee who would hesitate over a text message from an unknown number will open an invoice PDF from a supplier they have worked with for years without a second thought. That asymmetry is the product being exploited here, not any particular vulnerability.

It also means your own mailbox is somebody else's attack surface. The compromised corporate accounts in this campaign were not the final targets; they were the delivery mechanism aimed at their contact lists. A hijacked mailbox becomes a phishing platform with a perfect reputation, which is the same dynamic behind AiTM session hijacking of Outlook accounts and behind kits like Greatness, which spoofed RingCentral to reach Microsoft 365 inboxes. Greatness had to forge a trusted sender. The campaigns in Gen's report skipped that step by owning one outright.

Scale that against Gen's headline figures and the picture sharpens: scams accounted for nearly 46% of all detections in H1 2026, and the company sent 3.3 million breach notification alerts, up 628.1% over H2 2025. Every one of those breaches is a supply of working credentials for the next round of authenticated phishing.

What to Do Right Now

• Stop treating an SPF and DKIM pass as a trust signal for content. It authenticates a domain, not an intent. Weight attachment and link analysis independently of authentication results.
• Verify every cryptocurrency address after pasting, character by character at both ends and in the middle. Send a small test transaction before a large one.
• Audit browser extensions and system proxy settings on any machine used for banking. Both are the terminal step of the first chain and both are visible without specialist tooling.
• Alert on PowerShell spawned by a browser or an email client, and on script files delivered as attachments or downloaded from a mail link. That is the pivot point in the chain, and it is detectable.
• Confirm unexpected invoices and payment detail changes through a phone number you already had, never one supplied in the message. Mail from a genuinely compromised partner will survive every other check you make.
• Follow CISA's guidance on phishing resistant MFA for your own mailboxes. Keeping your accounts out of the compromised pool protects your contacts as much as it protects you.

The through line Gen draws across the whole report is that attackers are moving closer to trusted context rather than trying to break through it. An email from a real business partner, a browser you configured yourself, a clipboard you have used ten thousand times. None of those look like an attack surface until one of them is.