The banking-malware campaign that Gen Threat Labs tracked through the first half of 2026 did not need to imitate a trusted sender. In several cases, the messages came from corporate mailboxes attackers had already taken over, so the email genuinely originated from the business it claimed to represent. (Source: BleepingComputer)
That distinction changes the math on email security. When a message leaves through authorized infrastructure, SPF and DKIM checks can still pass, and reputation systems see a sending domain with legitimate history. If your filtering depends on sender authentication to sort good mail from bad, that layer returns a clean verdict on this traffic.
The lures matched what the recipients already expected to receive: shipment notices, invoice-related messages, and scanned document notifications. One told the recipient only that a scanned copy of a shipment was attached. Nothing about the message asked the reader to make a judgment call about the sender.
The campaign concentrated on users in Czechia, Slovakia, Poland and Lithuania, with indicators pointing toward GepyS banking malware at the end of the chain. This is targeted delivery through existing business correspondence, not volume phishing sprayed at random addresses.
Gen recorded comparable regional activity in H1 2026 using the same trusted-workflow pattern with different payloads:
- Italy — fake invoice PDFs, including Booking.com-themed lures, leading to Vercel-hosted scripts with per-victim JavaScript obfuscation, Blogspot-hosted PowerShell stages, and XWorm
- Poland — invoice-themed phishing delivering a steganographic .NET loader that installed Remcos RAT
- Central and Eastern Europe — attachment-launched JavaScript droppers reaching banking functionality
For context on volume, Gen reports that scams accounted for almost 46% of its threat detections in H1 2026, with malvertising close to another 30%.
The business consequence is straightforward. A supplier or client whose mailbox is compromised becomes the delivery channel into your finance and operations teams, and the invoice your staff opens is arriving from a real correspondent with a real history.
Attack Chain: From Compromised Thread to Remcos, GepyS, and XWorm Installation
The banking chain ran five stages: attachment → JavaScript dropper → PowerShell stages → shellcode loader → proxy and browser manipulation. Each handoff moved execution into a different interpreter or memory context, which means a single detection on any one stage sees only a fragment of the operation.
Stage one arrived as an attachment tied to a routine business pretext — shipment notices, invoice messages, and scanned-document notifications aimed at users in Czechia, Slovakia, Poland and Lithuania. Opening it launched a JavaScript dropper (T1059.007), which handed off to PowerShell (T1059.001) to pull additional stages. The user-facing action was one double-click on a file that looked like paperwork they were already expecting.
Stage three is where the operators spent their effort. Gen Threat Labs describes one payload as a 32-bit position-independent loader with:
- MMX and SSE junk instructions padding the disassembly
- Jumps into the middle of instructions, breaking linear disassembly and confusing automated decompilers
- A decryption routine built on an LFSR-generated keystream followed by XOR (T1140)
None of these techniques is new. Stacked together, they raise the cost of a quick static triage pass enough that an analyst working a queue may deprioritize the sample and move on.
The final banking functionality — indicators point to GepyS — did not attack the bank. It modified proxy settings and installed a browser add-on (T1176, T1090), placing the malware between the browser and the session the user had already authenticated. The victim logs in normally with correct credentials and any second factor, and the manipulated session sits underneath that. For a business, the loss shows up as an authorized-looking transfer rather than an account-takeover alert.
Two parallel H1 campaigns reused the regional and operational pattern with different payloads, and the distinction between them is mostly in the loader and the hosting.
- Italy — XWorm: fake invoice PDFs, including Booking.com-themed lures, pointed to scripts hosted on Vercel with per-victim JavaScript obfuscation, then PowerShell stages hosted on Blogspot. Per-victim obfuscation means each retrieved script differs, so file-hash matching on the intermediate stage produces one hit and then goes stale.
- Poland — Remcos RAT: invoice-themed phishing delivered a steganographic .NET loader (T1027.003), hiding the payload inside carrier data so the file on disk does not present as executable code to a scanner.
The reusable pattern across all three is the staging infrastructure, not the endpoint payload. Both the Italian and Polish chains stood on services your users reach every day — a deployment platform and a blogging host — so a network verdict based on domain reputation returns clean for the retrieval step. GepyS, XWorm and Remcos are interchangeable in that model: the loader decides what lands, and the operator can swap it.
Gen's report does not publish sample hashes, C2 addresses or IP ranges for these chains, so validation work has to run on behavior. The artifacts worth correlating are an office-document or archive attachment spawning a script interpreter, PowerShell fetching content from a developer-hosting or blogging domain, shellcode executing without a corresponding file write, and system proxy configuration or browser extension inventory changing shortly afterward. Treated separately, those four events look ordinary; in sequence within a short window, they describe this chain.
Business and Operational Risk from Remote Access Trojans in Email Infrastructure
A compromised mailbox is not just a phishing problem — it is an authenticated foothold inside your business communications. Whoever controls that account can read every contract, invoice, wire instruction and password reset sitting in the folder history, and can send from it with your domain's full sending reputation behind them.
The banking chain ends with proxy settings modified and a browser add-on installed, placing the malware next to the victim's banking session. For a finance workstation, that means fraudulent activity originates from a legitimately authenticated session on a known device. Your bank's logs show your user, your browser, your network path — which makes disputing a transfer harder and slower than a straightforward account-takeover claim.
The second-order exposure is who else receives mail from that account. If the compromised user is vendor-facing — accounts payable, procurement, client services — your mailbox becomes the delivery infrastructure for the next wave, and your customers open the attachment because the thread is real.
- Supply-chain liability: malware reaching your clients from your domain raises contractual and reputational questions that outlast the incident itself.
- Notification duties: unauthorized access to a mailbox usually means unauthorized access to whatever personal or commercial data that mailbox held, which is what triggers regulatory reporting.
- Domain reputation: once your sending history is used to carry payloads, downstream filtering of your legitimate mail becomes less predictable.
Scale gives you a sense of how routine this has become across the consumer and business edge.
Gen blocked 114.2 million e-shop scam attacks and 20.3 million tech support scam attacks in the first half of 2026, with scams accounting for almost 46% of all detections and malvertising nearly another 30%.
The cryptocurrency campaign creates a different kind of loss on your balance sheet. The Rust-compiled clipper watches copied content for wallet addresses across 21 blockchain types, including BTC, ETH and LTC, and swaps in an attacker-controlled destination before you paste. The blockchain is not compromised and the wallet's cryptography is not broken — the transaction your treasury team approves is valid, and it settles to the wrong party with no reversal mechanism.
Because wallet addresses are long, visually noisy strings, the practical check most people perform is the first and last few characters. Attackers pick replacement addresses that survive that glance. If your firm makes any cryptocurrency payments — payroll for contractors, vendor settlement, exchange transfers — the loss is realized at the moment of signing, and there is no chargeback path to recover it.
The command-and-control design also changes what your incident response actually costs. The malware reads infrastructure pointers from data stored in a smart contract on Binance Smart Chain through EtherHiding, so the resolved domain, URL or IP can be taken down or replaced while the on-chain pointer stays readable. A network indicator list built during your first day of investigation ages quickly, which extends scoping work, extends retainer hours and extends the window in which the same operator reaches the same hosts under new names.
For risk and compliance teams, the useful framing is that both campaigns produce records that look correct. An authenticated email from a real business partner, a bank session from a known device, a valid blockchain transaction — each artifact you would normally use to establish that a transaction was authorized. That affects insurance claims, audit evidence and how long it takes anyone to notice the loss.
Detection and Immediate Response for Hijacked Email Threads
First two hours
Start with mailbox rules, because that is where an account takeover leaves the clearest trace. Pull the inbox rule set and message-forwarding configuration for every account tied to the suspicious mail, and look for rules that forward externally or auto-file replies into rarely opened folders — attackers use those to keep a conversation running without the real owner seeing responses.
Next, query your mail logs for attachments and links delivered inside existing reply threads, not just first-contact messages. Filter on scanned-document, shipment and invoice subject lines across the same time window, and pull the recipient list so you know how many endpoints are in scope.
Then isolate any workstation where a user opened the attachment. Use network containment through your EDR agent instead of powering the machine down, so volatile memory and the loader's staging artifacts survive for analysis.
Next 24 to 48 hours
Treat the mailbox owner's credentials as fully exposed. Reset the password, revoke active session tokens and refresh tokens, review any OAuth application consents granted to that account, and re-enrol MFA rather than trusting the existing factor — a stolen session cookie survives a password change on its own.
In environments Capstone manages, Adlumin ITDR correlates authentication events across mailboxes and endpoints, so a sign-in from an unusual location followed by a new forwarding rule surfaces as one identity event rather than two unrelated log lines.
On the isolated endpoints, hunt the sequence rather than any single artifact:
- Script interpreter execution spawned by a document or archive handler, followed by a PowerShell child process reaching out to an external host.
- Changes to the user's proxy configuration in the registry, plus any browser extension installed outside your approved list.
- Outbound connections from the browser process to hosts that do not match your normal banking or SaaS destinations.
- Credentials stored in the browser profile — rotate them, since the add-on sat inside the same session.
Search proxy and firewall logs for those destinations across every host, not only the confirmed one. Keep in mind that a domain-based indicator list ages quickly when operators rotate infrastructure, so pivot on the process behaviour and the parent-child chain as well as the network address.
Longer term
Move DMARC to an enforcing policy and align SPF and DKIM across all sending services. That stops spoofing of your domain by outsiders. It does not stop mail sent from a genuinely compromised account, which is why the enforcement work has to sit alongside post-delivery inspection and mailbox-takeover monitoring.
Content disarm and reconstruction strips active content from inbound attachments before delivery, which removes the dropper stage from documents that reach users through an otherwise trusted thread. Pair it with application control on files downloaded from mail, and restrict script interpreters for staff whose roles never require them.
Enforce MFA on every mailbox, including shared and service accounts, and apply conditional access so token reuse from a new location prompts re-authentication. Finally, segment finance and accounts-payable workstations from general user VLANs and from server management ranges, so a foothold on one endpoint does not reach payment systems or file shares directly.
Document which accounts were reset, which endpoints were reimaged, and which rules were removed, so a repeat of the same lure can be triaged against a known baseline.
Hunting for Remcos, GepyS, and XWorm in Your Environment
Per-victim JavaScript obfuscation, which the Italian invoice campaign used on its Vercel-hosted scripts, means every recipient received a structurally different first-stage file. Hash-based indicator lists will not surface those droppers, so validation has to run on behavior, structure and memory content instead of file reputation.
Start with process ancestry. The dropper-to-PowerShell handoff produces a script interpreter spawned by a document or archive handler, then a second interpreter spawned by the first — wscript.exe or cscript.exe as parent of powershell.exe, with an encoded or long command line. In a SentinelOne or equivalent EDR query, pivot on that parent-child pair over a 90-day window and pull the full command line, then join on the originating user to see how far the same pattern spread across the fleet.
The stage-three loader needs a different approach. Gen's analysis describes a 32-bit position-independent payload padded with MMX and SSE junk instructions, jumps into the middle of instructions, and an LFSR-generated keystream XORed against the payload body. Write YARA against those structural traits — dense unused SIMD sequences, misaligned jump targets, a tight shift-and-XOR decode loop — and run it against memory images rather than disk, because the shellcode stage exists only after PowerShell hands off.
- Configuration drift: enumerate proxy configuration across endpoints, including
AutoConfigURLandProxyServerunder the per-user Internet Settings key, and diff against your build standard. - Browser extensions: inventory installed add-on IDs per host and flag any ID present on fewer than a handful of machines. Sideloaded extensions on finance workstations deserve manual review.
- Staging platforms: search proxy and DNS logs for script or PowerShell retrieval from Vercel and Blogspot domains where the requesting process is not a browser.
Both platforms carry heavy legitimate traffic, so filter on process image first, then request pattern. That keeps the result set small enough for an analyst to close out in an afternoon instead of drowning the queue.
For the Remcos activity delivered through the Polish invoice wave, the loader was a steganographic .NET binary — payload bytes carried inside image data and decoded at runtime. Hunt for managed processes that read an image file and then perform a reflective assembly load in the same execution, and inspect .NET resource sections for embedded bitmaps whose entropy does not match ordinary graphics.
The Rust-compiled clipper is the cleanest behavioral hunt of the set. It watches copied content against wallet-address formats for 21 blockchain types including BTC, ETH and LTC, so an unsigned binary in a user-writable directory that repeatedly opens the clipboard is a strong candidate. Cross-reference with EtherHiding traffic: JSON-RPC calls to Binance Smart Chain endpoints originating from a process that is not a browser or wallet client.
Record the contract address, the read method, the returned pointer and the infrastructure it resolves to as a single linked artifact set in your case notes. The resolved domain will change; the on-chain data stays readable and gives investigators a stable pivot after a takedown.
False positives cluster in predictable places. Clipboard managers, password tools and remote-support agents all touch the clipboard legitimately; developer workstations query blockchain RPC endpoints as part of normal work; enterprise PAC file deployments write the same proxy keys the banking chain modifies. Baseline those populations before triage so the surviving hits are genuinely anomalous, which is what determines whether a hunt produces findings or noise.
What to Do First: Immediate Containment Steps
The containment action that matters most is cutting the attacker's authenticated access to the mailbox. Reset the account owner's password, revoke every active session and issued token, then isolate that user's endpoint from the network and hold it for forensic imaging. A password change on its own leaves existing sessions valid, so the revocation step is what actually closes the door.
Isolation before imaging preserves memory and disk state you will need later, and it stops the machine from reaching further into your environment while you work. Keep the device powered on and off the network rather than wiping and reissuing it.
Thread hijacking works because the message arrives inside a conversation your staff already started, so the usual skepticism about unfamiliar senders never triggers. Give your users a single rule they can apply without judgment calls: if an attachment or link appears in an ongoing thread that neither party discussed, confirm it with the sender by phone, using a number from your own records rather than one in the signature block.
If your exposure involves the clipper campaign instead, containment has a different shape. The Rust-compiled hijacker watched copied content across 21 blockchain types and swapped the destination locally, so any payment approved on an affected machine needs the full address compared against your original record. Because the C2 pointers were read from smart-contract data on Binance Smart Chain through EtherHiding, blocking the domain you found does not end the operator's access to that host — the pointer can be updated and the host replaced.
If any indicator matches in your logs or on the endpoint, engage your incident response provider and treat the mailbox as attacker-controlled until the investigation says otherwise.
