--- title: Real emails, hijacked payments: Two H1 2026 attack chains description: Gen Digital's H1 2026 Threat Report details two distinct attack chains observed in the first half of the year. The first is a banking malware campaign... canonical: https://daily.dev/posts/real-emails-hijacked-payments-two-h1-2026-attack-chains-pvqioqgmf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Real emails, hijacked payments: Two H1 2026 attack chains | daily.dev og:description: Gen Digital's H1 2026 Threat Report details two distinct attack chains observed in the first half of the year. The first is a banking malware campaign... og:url: https://daily.dev/posts/real-emails-hijacked-payments-two-h1-2026-attack-chains-pvqioqgmf og:image: https://api.daily.dev/og/posts/PVqIOQgMF.png og:image:alt: Real emails, hijacked payments: Two H1 2026 attack chains og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Real emails, hijacked payments: Two H1 2026 attack chains **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 6 min read · 0 upvotes · 0 comments ## Summary Gen Digital's H1 2026 Threat Report details two distinct attack chains observed in the first half of the year. The first is a banking malware campaign targeting Central/Eastern European users via compromised corporate email accounts, where legitimate mailboxes bypassed SPF/DKIM checks to deliver a JavaScript dropper that progressed through PowerShell stages to shellcode, ultimately manipulating browser proxy settings to intercept banking sessions. The second campaign deployed a Rust-compiled clipboard hijacker monitoring 21 blockchain types, silently replacing copied wallet addresses with attacker-controlled ones. This clipper used EtherHiding — storing C2 infrastructure pointers in Binance Smart Chain smart contracts — making traditional domain-based takedowns ineffective. Defenders are advised to correlate the full attack sequence rather than treating individual events in isolation, restrict script interpreters, monitor clipboard-modifying processes, and verify full wallet addresses before approving cryptocurrency transactions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does EtherHiding work for malware C2 infrastructure? EtherHiding stores infrastructure pointers — domain, URL, or IP — inside a Binance Smart Chain smart contract rather than hardcoding them. The malware reads these pointers on-chain to locate attacker-controlled backend servers. Because the smart contract data is publicly readable and cannot be removed through standard takedown processes, blocking a resolved C2 domain only temporarily disrupts the campaign; the contract address remains a persistent pivot point for investigators. _Teams tracking crypto-targeting malware find the full EtherHiding indicator chain discussed alongside other threat patterns on daily.dev._ ### How can I detect a clipboard hijacker targeting cryptocurrency wallet addresses? Defenders should monitor for processes that modify clipboard contents, watch for wallet-address pattern matching in running applications, and flag blockchain queries from processes with no legitimate reason to make them. Users should verify the complete destination address shown by their signing device immediately before approving any transaction, since attackers rely on victims checking only the first and last few characters of the long address strings. _Developers and security engineers working on crypto-adjacent products track defensive techniques like these on daily.dev._ ## Similar posts on daily.dev - [Evolution of Web3 in Cloud Supply Chain Attacks](https://daily.dev/posts/evolution-of-web3-in-cloud-supply-chain-attacks-3unzi5cdy) · Unit 42 · 0 upvotes · 0 comments - [Crypto Heist Fueled by Elaborate Fake Reputation Campaign](https://daily.dev/posts/crypto-heist-fueled-by-elaborate-fake-reputation-campaign-jl8cj7yzf) · Dark Reading · 1 upvotes · 0 comments - [Multi Brand Themed Phishing Campaign Harvests Credentials](https://daily.dev/posts/multi-brand-themed-phishing-campaign-harvests-credentials-k0xani0lt) · Cyble · 0 upvotes · 0 comments - [Hackers Abuse Blockchain Smart Contracts to Spread Malware via Infected WordPress Sites](https://daily.dev/posts/hackers-abuse-blockchain-smart-contracts-to-spread-malware-via-infected-wordpress-sites-85eqcwd21) · The Hacker News · 1 upvotes · 0 comments - [Russians posing as Signal support to launch phishing raids](https://daily.dev/posts/russians-posing-as-signal-support-to-launch-phishing-raids-numtsppyp) · The Register · 0 upvotes · 0 comments --- Tags: [#crypto](https://daily.dev/tags/crypto), [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/real-emails-hijacked-payments-two-h1-2026-attack-chains-pvqioqgmf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Real emails, hijacked payments: Two H1 2026 attack chains","url":"https://daily.dev/posts/real-emails-hijacked-payments-two-h1-2026-attack-chains-pvqioqgmf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/real-emails-hijacked-payments-two-h1-2026-attack-chains-pvqioqgmf"},"datePublished":"2026-08-07T14:06:22.511Z","dateModified":"2026-08-07T14:06:52.464Z","description":"Gen Digital's H1 2026 Threat Report details two distinct attack chains observed in the first half of the year. The first is a banking malware campaign...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a408293e63b3ee2317d240f692771a9b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a408293e63b3ee2317d240f692771a9b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/real-emails-hijacked-payments-two-h1-2026-attack-chains-pvqioqgmf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"crypto,malware,phishing","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Real emails, hijacked payments: Two H1 2026 attack chains"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/real-emails-hijacked-payments-two-h1-2026-attack-chains-pvqioqgmf#faq","mainEntity":[{"@type":"Question","name":"How does EtherHiding work for malware C2 infrastructure?","acceptedAnswer":{"@type":"Answer","text":"EtherHiding stores infrastructure pointers — domain, URL, or IP — inside a Binance Smart Chain smart contract rather than hardcoding them. The malware reads these pointers on-chain to locate attacker-controlled backend servers. Because the smart contract data is publicly readable and cannot be removed through standard takedown processes, blocking a resolved C2 domain only temporarily disrupts the campaign; the contract address remains a persistent pivot point for investigators. Teams tracking crypto-targeting malware find the full EtherHiding indicator chain discussed alongside other threat patterns on daily.dev."}},{"@type":"Question","name":"How can I detect a clipboard hijacker targeting cryptocurrency wallet addresses?","acceptedAnswer":{"@type":"Answer","text":"Defenders should monitor for processes that modify clipboard contents, watch for wallet-address pattern matching in running applications, and flag blockchain queries from processes with no legitimate reason to make them. Users should verify the complete destination address shown by their signing device immediately before approving any transaction, since attackers rely on victims checking only the first and last few characters of the long address strings. Developers and security engineers working on crypto-adjacent products track defensive techniques like these on daily.dev."}}]} ```