Gen Digital's H1 2026 Threat Report reveals sophisticated attack chains using hijacked business emails and cryptocurrency clipboard manipulation. Scams and malvertising now dominate the global cyber threat landscape.
Key Takeaways
- Attackers are leveraging compromised legitimate business accounts to bypass email security.
- Clipboard hijacking is being used to redirect cryptocurrency payments to hacker wallets.
- Scams and malvertising account for a combined 76% of total threat detections.
The Gen Digital H1 2026 Threat Report has unveiled a shifting landscape in cyber warfare, where attackers are moving away from breaking systems to exploiting trusted workflows. In the first half of 2026, scams accounted for nearly 46% of threat detections, while malvertising contributed another 30%, highlighting a massive surge in social engineering-based attacks.
Sophisticated Attack Methodologies
The report highlights two distinct, highly effective attack chains. The first is a banking-malware campaign targeting users in Central and Eastern Europe, including Czechia, Slovakia, Poland, and Lithuania. Unlike traditional phishing that uses fake domains, these attackers use compromised legitimate corporate mailboxes. Because the emails originate from authorized infrastructure, standard SPF and DKIM authentication checks often pass undetected.
Why This Matters
BozokMedia analysis shows that the danger lies in the 'illusion of legitimacy.' When a shipment notice or an invoice comes from a verified business partner's actual email address, the psychological barrier for the victim is removed. This allows JavaScript droppers and PowerShell stages to execute, ultimately manipulating the victim's browser and proxy settings to hijack banking sessions.
Modern cyber threats are no longer just about breaking code; they are about breaking the user's trust in legitimate processes.
The second major threat involves cryptocurrency users. Attackers utilize a Rust-compiled clipboard hijacker that monitors for blockchain wallet addresses. When a user copies a BTC, ETH, or LTC address, the malware instantly replaces it with an attacker-controlled address. Since wallet addresses are long and visually complex, most users fail to notice the change before signing the transaction.
| Feature | Banking Malware Campaign | Crypto Clipboard Campaign |
|---|---|---|
| Primary Vector | Compromised Business Emails | Clipboard Hijacking (Copy-Paste) |
| Targeted Asset | Banking Sessions & Browsers | Cryptocurrency Wallets |
| Core Technology | JavaScript / PowerShell | Rust-based Clipper |
Frequently Asked Questions
1. How can I protect myself from clipboard hijacking?
Always double-check the first and last few characters of a wallet address after pasting it into your transaction window.
2. Why do legitimate emails sometimes contain malware?
Hackers often compromise real business accounts first, allowing them to send malicious attachments that appear completely authentic to security filters.
