Bank and crypto attacks: how hackers bypassed trusted systems in 2026

In the first half of 2026, Gen Threat Labs tracked two attack chains where attackers leveraged legitimate accounts, browser settings, and blockchain data to bypass security defenses. These cases show that successful attacks do not always require breaking the trusted system in front of the user.

According to the Gen Threat Report for H1 2026, scams accounted for nearly 46% of all detected threats, while malvertising represented about 30%. During this period, the company blocked 114.2 million e-shop scam attacks and 20.3 million tech support scam attacks. However, these figures do not reveal how the initial lure turned into script execution, how the script altered browser or proxy settings, or how a wallet address was swapped before the victim signed a transaction.

The first investigated campaign targeted banking customers in Czechia, Slovakia, Poland, and Lithuania. The lures looked like ordinary business emails: shipment notices, invoice-related messages, and scanned document notifications. Some messages simply told recipients that a scanned copy of a shipment was attached. In several cases, the emails were sent from compromised corporate mailboxes. Attackers did not spoof the sender address — they used already hijacked accounts. SPF and DKIM could still pass validation because the message was sent through authorized infrastructure, while reputation systems saw a sender with legitimate history.

The attachment launched a JavaScript dropper, then the chain moved through PowerShell stages before reaching shellcode and banking functionality. Available indicators pointed to the GepyS malware. Ultimately, the attack led to changes in proxy and browser settings on the victim's device.

The second campaign involved cryptocurrency. Attackers used a Rust-based clipper that swapped the wallet address locally before the transaction was signed. Command-and-control infrastructure pointers were retrieved from the Binance Smart Chain blockchain. After the address swap, the blockchain recorded a valid transaction, but funds went to the attackers. This attack did not require breaking a trusted system — it was enough to alter data on the user's side.

Both campaigns demonstrate that traditional defense methods relying on sender verification or transaction integrity may be insufficient. Attackers actively exploit the trust that users and systems place in legitimate components, whether corporate email or a public blockchain.