Real emails, hijacked payments: Two H1 2026 attack chains

Two distinct attack chains observed in the first half of 2026 highlight sophisticated threat actor tactics. One campaign leveraged compromised corporate email accounts to deliver banking malware through a series of script executions and system modifications. The second campaign utilized a Rust-based clipboard hijacker to alter cryptocurrency transaction destinations, with command-and-control infrastructure details hidden within a blockchain smart contract.