Gen H1 2026 Report: Attackers Hijack Trusted Workflows to Bypass Security
New research reveals sophisticated banking and crypto campaigns that manipulate legitimate accounts and clipboards to deceive users.
Cybercriminals are increasingly abandoning attempts to break encryption in favor of manipulating the environments users already trust. According to the H1 2026 Threat Report from Gen—the parent company of Norton, Avast, and LifeLock—attackers are now focusing on "trusted workflow" attacks that hijack legitimate accounts and local system data to execute high-value theft.
Gen's telemetry shows that scams dominated the threat landscape in the first half of the year, accounting for nearly 46% of all detections, while malvertising made up almost 30%. During this period, the company blocked 114.2 million e-shop scam attacks and 20.3 million tech support scams. Among these threats, two specific attack chains stood out for their ability to bypass traditional trust mechanisms.
The Banking Chain: Bypassing Email Verification
One campaign targeted users across Czechia, Slovakia, Poland, and Lithuania by exploiting compromised corporate mailboxes. By sending phishing lures from legitimate accounts, attackers successfully bypassed SPF and DKIM checks—the standard protocols used to verify email senders.
The technical sequence began with the compromised mailbox, which delivered a JavaScript dropper. This triggered a series of PowerShell stages and a shellcode loader, eventually leading to proxy and browser manipulation linked to GepyS banking malware. Because the initial email originated from a trusted corporate source, traditional security markers failed to alert the victims.
The Crypto Chain: Blockchain-Based C2
Simultaneously, a cryptocurrency-focused campaign deployed a clipper written in Rust. This malware monitored 21 different blockchain types, including Bitcoin, Ethereum, and Litecoin, to identify and replace wallet addresses in the user's clipboard during transactions.
To protect its backend, the malware utilized a technique called "EtherHiding" on the Binance Smart Chain. By storing command-and-control (C2) infrastructure pointers within a smart contract, the attackers made their infrastructure significantly harder for security researchers to locate and take down.
Why It Matters
These findings signal a critical shift in the threat landscape: a "verified" sender or a valid blockchain transaction is no longer a guarantee of safety. By hijacking the "last mile" of user interaction—the browser session or the clipboard—attackers can steal funds even when the underlying security infrastructure remains intact. This evolution renders many legacy trust indicators obsolete.
What's Next
Defending against these tactics requires a move toward behavioral correlation and full-string verification for all cryptocurrency transactions. As attackers continue to leverage legitimate corporate infrastructure and decentralized smart contracts to hide their tracks, security tools must evolve to detect anomalies in user behavior rather than relying solely on static reputation lists.