Cybersecurity researchers have detailed two distinct attack campaigns observed in the first half of 2026, both of which leveraged legitimate system functions or compromised trusted accounts to achieve their objectives. One campaign focused on banking fraud through business email compromise and browser manipulation, while the other targeted cryptocurrency users with a Rust-based clipboard hijacker that retrieved command-and-control infrastructure from the Binance Smart Chain.
The banking-malware campaign primarily targeted users in Czechia, Slovakia, Poland, and Lithuania. Attackers initiated the chain by sending lures disguised as routine business communications, such as shipment notices, invoices, or scanned document notifications. Crucially, these emails originated from corporate mailboxes that had already been compromised, meaning they passed sender authentication checks like SPF and DKIM and benefited from a legitimate sender history.
Upon opening an attachment, typically a JavaScript dropper, the attack progressed through multiple PowerShell stages before deploying shellcode and banking malware. The indicators pointed to the GepyS malware family. This malware then modified proxy settings and installed a browser add-on, positioning itself to intercept banking sessions. Analysis of a stage-three payload revealed a 32-bit position-independent loader employing MMX and SSE junk instructions, jumps into instruction middles, and an LFSR-generated keystream for XOR-based decryption, techniques that collectively complicated static analysis.
This banking campaign highlights a trend where initial trust decisions, such as opening an email from a seemingly legitimate source, are exploited. Similar regional campaigns in H1 2026 included fake Booking.com invoice PDFs in Italy leading to XWorm via Vercel-hosted scripts and Blogspot-hosted PowerShell, and invoice-themed phishing in Poland delivering Remcos RAT through a steganographic .NET loader.
The second campaign focused on cryptocurrency theft by manipulating clipboard data. The final payload was a Rust-compiled clipboard hijacker designed to monitor copied content for wallet addresses across 21 blockchain types, including BTC, ETH, and LTC. When a supported address was detected, the malware silently replaced it with an attacker-controlled address.
From the victim's perspective, the transaction process appeared normal: they copied an address, pasted it into their wallet or exchange, and approved the payment. The blockchain itself remained uncompromised, and the wallet's cryptographic security was not breached. Instead, the destination address was altered locally before the transaction was signed, exploiting the difficulty users face in verifying long, complex wallet addresses. Many users only check the first and last few characters, which attackers can mimic in their replacement addresses.
A notable aspect of this cryptocurrency campaign was its command-and-control (C2) design. The malware utilized Binance Smart Chain, specifically through a technique known as EtherHiding, to resolve its C2 infrastructure. It did not store the entire backend on-chain but rather retrieved pointers to attacker-controlled infrastructure from data embedded in a smart contract. While the resolved domain, URL, or IP address could be blocked or taken down, the smart-contract data remained publicly readable, offering a persistent investigative pivot and making takedown efforts more challenging. This approach renders simple network indicator-of-compromise lists quickly obsolete.
To counter these sophisticated attacks, researchers recommend a multi-layered detection strategy. For the banking campaign, correlating events like JavaScript execution from an attachment, PowerShell retrieving stages, shellcode execution, and unexpected proxy or browser extension changes is crucial, rather than treating them as isolated incidents. Organizations should consider restricting script interpreters for users who don't require them, applying application control policies to downloaded attachments, and monitoring for mailbox takeover.
For the cryptocurrency campaign, defenders should monitor for processes that modify the clipboard, applications making unusual blockchain queries, and track both the smart-contract pointer and the infrastructure it resolves. Users are advised to verify the full destination address displayed by their signing device or wallet immediately before approving any cryptocurrency transaction. Using address books or allowlists can reduce manual entry errors, and any new or changed destination should prompt a full address comparison, not just a check of the initial and final characters. Both campaigns underscore that initial trust decisions can be exploited when the subsequent workflow is compromised, necessitating comprehensive detection and verification across all steps of a digital interaction.
