H1 2026 Payment Hijacks: How Trust Exploits Led to Two Attack Chains

The H1 2026 Payment Hijacks: It's About Trust, Not Just Malware

Despite our best efforts in email security, messages from known vendors are still leading to payment hijacks. Organizations have invested heavily in email gateways, user training, and modern threat protection, yet these measures are often circumvented. But the first half of 2026 shows attackers still bypass those defenses, not by breaking cryptography, but by exploiting the very trust we rely on in our daily digital interactions. These H1 2026 payment hijacks highlight a critical shift in cyberattack methodologies.

These insights stem from a BleepingComputer analysis of two distinct attack chains observed in H1 2026, which also references Gen Digital's H1 2026 Threat Report for broader landscape context. These aren't about zero-days in your firewall; they're about surgical manipulation of user behavior and trusted workflows. It's a shift where the human element and established digital processes become the primary vulnerability, leading to these sophisticated H1 2026 payment hijacks.

When a "Legitimate" Email Delivers Banking Malware

The first campaign targeted users in Czechia, Slovakia, Poland, and Lithuania. Its effectiveness stemmed from a key detail: the emails didn't come from some spoofed domain or a newly registered phishing site. They came from compromised corporate mailboxes. An attacker takes over a legitimate business account, then uses it to send malicious emails, often as replies within existing threads, making this a critical vector for H1 2026 payment hijacks.

Here's the chain:

1. Mailbox Takeover: Attackers gain access to a corporate email account.
2. Trusted Delivery: From this compromised account, they send emails that look like shipment notices, invoices, or scanned document notifications, leveraging T1566.001 (Phishing: Spearphishing Attachment). The legitimacy of the sender ensures SPF and DKIM checks pass, and sender reputation systems see a clean history, providing perfect cover for these H1 2026 payment hijacks.
3. Initial Payload: The email carries a JavaScript dropper as an attachment. Users, trusting the familiar sender and relevant subject, are tricked into opening it.
4. Staged Execution: The JavaScript dropper kicks off a series of PowerShell stages, executing T1059.001 (Command and Scripting Interpreter: PowerShell). This stage initiates a series of PowerShell commands, often using obfuscation and evasion techniques, such as 32-bit position-independent loaders, MMX/SSE junk instructions, jumps into the middle of instructions, and decryption routines based on LFSR-generated keystreams followed by XOR, which complicate static and dynamic analysis by security tools.
5. Browser Manipulation: The final shellcode loader installs proxy settings (T1090.002: Proxy: SOCKS Proxy) and a browser add-on (T1176: Browser Extensions). The goal isn't just credential theft; it's intercepting banking sessions. The malware, identified as GepyS, positions itself to modify transaction details before a user even sees them on their screen, a classic tactic in H1 2026 payment hijacks.

The practical impact is that a user might log into their bank, initiate a payment, and the malware silently changes the destination account or amount right before confirmation. The user perceives a legitimate transaction, but it has already been altered.

This isn't a novel concept, but the scale and reliance on compromised real mailboxes make it particularly difficult to detect. Other regional campaigns in H1 2026, like the XWorm attacks in Italy using fake invoice PDFs (Booking.com-themed) that led to Vercel-hosted scripts and Blogspot-hosted PowerShell stages, or Remcos RAT in Poland via invoice-themed phishing and steganographic loaders, show a similar pattern: attackers are employing sophisticated methods for delivery and evasion, but the core vulnerability is often the initial trust in a seemingly legitimate communication, enabling these H1 2026 payment hijacks.

The Clipboard Hijackers: Stealing Crypto One Paste at a Time

Another campaign targets cryptocurrency users by exploiting trust through clipboard manipulation. This involves a Rust-compiled clipboard hijacker, a new vector for H1 2026 payment hijacks.

Here's how it works:

1. Infection: The malware is installed on the user's system.
2. Silent Monitoring: Once installed, the malware sits quietly, monitoring copied content (T1115: Clipboard Data). It's looking for patterns that match cryptocurrency wallet addresses across 21 different blockchain types, including BTC, ETH, and LTC.
3. Address Swap: The moment a user copies a legitimate wallet address, the hijacker steps in. It replaces that address in the clipboard with an attacker-controlled address. This happens locally, on the machine, before it is pasted.
4. User Error: Most users tend to verify only the first few and last few characters of a long wallet address, a common shortcut.
5. Irreversible Loss: The user pastes the address, confirms the transaction with their wallet or signing device, and inadvertently sends their crypto to the attacker. The blockchain isn't compromised, the wallet's cryptography isn't broken; funds are simply sent to the wrong address because the clipboard was manipulated, a cunning method for H1 2026 payment hijacks.

The C2 architecture for this campaign is particularly effective. It uses Binance Smart Chain (BSC) and EtherHiding for C2 resolution (T1102.002: Web Service: Bidirectional Communication). This means the C2 infrastructure's domain, URL, or IP is not hardcoded but dynamically resolved from data stored in a smart contract. This approach rapidly renders traditional network IoC lists obsolete (T1562.001: Impair Defenses: Disable or Modify Tools) and significantly complicates takedowns, as smart-contract data remained publicly readable, making C2 harder to remove via normal takedown processes.

What We Need to Change

While current discussions around these reports are largely technical summaries, indicating a factual reception, a deeper understanding of their broader implications is essential for evolving effective defenses. These H1 2026 payment hijacks signal a need to move beyond traditional signature-based detection and basic email filtering.

For the banking malware, relying solely on SPF/DKIM is insufficient. Effective security telemetry must correlate sender authentication with post-delivery telemetry, specifically JavaScript execution, PowerShell stages, shellcode activity, and any proxy or browser changes, as each step represents a significant indicator of compromise. Security systems must not lower priority based on legitimate sender history if the mailbox itself is compromised. Furthermore, organizations should restrict script interpreters for non-essential users and apply stringent application-control policies to downloaded attachments. Proactive alerting on unexpected proxy or browser-extension modifications, alongside continuous monitoring for mailbox takeover, is critical to prevent future H1 2026 payment hijacks.

Regarding the crypto clipper, active monitoring for processes that modify the clipboard, particularly those matching wallet address patterns, is essential. This should be coupled with tracking blockchain queries originating from applications that should not be making them. Given the dynamic C2 resolution, it is imperative to track smart-contract pointers and their resolved infrastructure together to maintain effective threat intelligence. From a user behavior standpoint, the most critical defense is full destination address verification: users must verify the entire destination address displayed by their signing device or wallet immediately before approving any transaction. Utilizing address books or allowlists can mitigate risk, and for any first-time or changed destination, a full address comparison is non-negotiable, countering the common user shortcut of checking only partial addresses, thereby protecting against H1 2026 payment hijacks.

These attacks show that the most successful exploits in H1 2026 often weren't about breaking complex systems. They were about breaking human trust and exploiting common user habits. Our defense strategies must evolve to reflect this reality, placing greater emphasis on human vigilance and the integrity of established digital processes, in conjunction with technical controls to combat H1 2026 payment hijacks.