Gen Digital's H1 2026 Threat Report details two distinct attack chains observed in the first half of the year. The first is a banking malware campaign targeting Central/Eastern European users via compromised corporate email accounts, where legitimate mailboxes bypassed SPF/DKIM checks to deliver a JavaScript dropper that progressed through PowerShell stages to shellcode, ultimately manipulating browser proxy settings to intercept banking sessions. The second campaign deployed a Rust-compiled clipboard hijacker monitoring 21 blockchain types, silently replacing copied wallet addresses with attacker-controlled ones. This clipper used EtherHiding — storing C2 infrastructure pointers in Binance Smart Chain smart contracts — making traditional domain-based takedowns ineffective. Defenders are advised to correlate the full attack sequence rather than treating individual events in isolation, restrict script interpreters, monitor clipboard-modifying processes, and verify full wallet addresses before approving cryptocurrency transactions.
Table of contents
The business email really came from a businessRead the Gen H1 2026 Threat ReportThe clipboard was the payment layerDetection has to follow the sequenceQuestions this post answers
How does EtherHiding work for malware C2 infrastructure?
EtherHiding stores infrastructure pointers — domain, URL, or IP — inside a Binance Smart Chain smart contract rather than hardcoding them. The malware reads these pointers on-chain to locate attacker-controlled backend servers. Because the smart contract data is publicly readable and cannot be removed through standard takedown processes, blocking a resolved C2 domain only temporarily disrupts the campaign; the contract address remains a persistent pivot point for investigators. Teams tracking crypto-targeting malware find the full EtherHiding indicator chain discussed alongside other threat patterns on daily.dev.
How can I detect a clipboard hijacker targeting cryptocurrency wallet addresses?
Defenders should monitor for processes that modify clipboard contents, watch for wallet-address pattern matching in running applications, and flag blockchain queries from processes with no legitimate reason to make them. Users should verify the complete destination address shown by their signing device immediately before approving any transaction, since attackers rely on victims checking only the first and last few characters of the long address strings. Developers and security engineers working on crypto-adjacent products track defensive techniques like these on daily.dev.