Gen Details Two H1 2026 Campaigns Using Hijacked Email and Crypto Clipboard Malware

Aug 7, 2026 · Original article ↗

Summary

Gen Threat Labs describes two H1 2026 campaigns: banking malware delivered through compromised business mailboxes manipulated proxies and browsers, while a Rust clipper replaced crypto addresses and used Binance Smart Chain for C2 pointers. The report also offers dete

Key points

Gen Threat Labs traced a banking-malware campaign targeting users in Czechia, Slovakia, Poland and Lithuania to lures sent from compromised corporate mailboxes.
The reported chain used a JavaScript dropper, PowerShell stages and a shellcode loader before manipulating proxy settings and installing a browser add-on; available indicators pointed to GepyS.
Analysis of one payload found a 32-bit position-independent loader, obfuscating instructions and an LFSR-generated keystream followed by XOR decryption.
A separate campaign used a Rust-compiled clipper that monitored clipboard content for wallet addresses across 21 blockchain types and replaced recognized addresses with attacker-controlled ones.
The clipper used smart-contract data on Binance Smart Chain to retrieve infrastructure pointers through EtherHiding; the report says tracking only resolved network indicators could become outdated.
The report recommends correlating banking-chain behaviors, monitoring clipboard modification and blockchain queries, tracking smart-contract pointers with resolved infrastructure, and verifying full crypto destinations before approval.

Article Details

Attack Vectors: A banking-malware campaign used compromised corporate mailboxes to send shipment, invoice, and scanned-document emails with attachments. Opening an attachment launched a JavaScript dropper, followed by PowerShell stages and a shellcode loader; the malware then modified proxy settings and installed a browser add-on.
A separate cryptocurrency campaign used a Rust-compiled clipboard hijacker that monitored copied wallet addresses and replaced them with attacker-controlled addresses before victims signed transactions. It retrieved infrastructure pointers from data stored in a Binance Smart Chain smart contract.
Comparable campaigns used fake invoice PDFs to deliver scripts and PowerShell stages leading to XWorm in Italy, and invoice-themed phishing to deliver a steganographic .NET loader that installed Remcos RAT in Poland.
Defensive Notes: Correlate attachment launches, JavaScript, PowerShell stage retrieval, shellcode execution, proxy changes, and new browser extensions as one sequence.
Do not lower alert priority solely because an email sender has a legitimate history; monitor for mailbox takeover and treat compromised accounts as potential delivery infrastructure.
Where operationally possible, restrict script interpreters for users who do not need them, apply application-control policies to downloaded attachments, and alert on unexpected proxy or browser-extension changes.
Monitor clipboard-modifying processes, wallet-address pattern matching, and blockchain queries from applications that have no reason to make them. Track smart-contract pointers together with the infrastructure they resolve to.
Before approving cryptocurrency payments, verify the full destination shown by the signing device or wallet. Use address books or allowlists where appropriate, and fully compare first-time or changed destinations.