The Emails Were Real. The Money Wasn't: Inside Two 2026 Attacks

Michael Miller · 2026-08-07

You check your email. The sender looks right. The name matches. The message is polite and professional. So you click. You type your banking credentials. You confirm the payment. And then the money vanishes. That's not a hypothetical scenario from a paranoid security blog. That's what actually happened in two separate attack chains detailed in Gen's H1 2026 Threat Report. Both campaigns were sophisticated, but they targeted different weaknesses: one exploited our trust in email, the other exploited our habit of copying and pasting. ### The Banking Heist That Hiding Behind Real Emails The first attack chain is the stuff of nightmares for any finance team. It started with compromised business inboxes. Attackers didn't spoof addresses or use lookalike domains. They took over real accounts, often through phishing or credential stuffing, and then waited. They studied the conversation history. They learned the language of the business. They understood which invoices were pending and which vendors were trusted. Then, when the moment was right, they sent a legitimate-looking email from a legitimate account, asking for a payment to be made. The twist? They used browser manipulation to make the transaction look correct. While the victim was logged into their banking portal, the malware altered the page in real time. The displayed account number was the attacker's. The confirmation page matched the original request. The victim never saw the switch until it was too late. This wasn't a smash-and-grab. It was a slow, patient, and deeply human attack. It worked because the emails were real. The trust was earned. The manipulation happened silently in the background, hidden by the very tools we use to protect ourselves. ### The Clipboard Hijack That Redirected Crypto Payments The second attack chain was simpler in concept but equally devastating. It targeted cryptocurrency users through clipboard hijacking. Here's how it works: when you copy a wallet address to send a payment, the malware swaps it for the attacker's address. You paste, you verify the first few characters, and you hit send. The transaction goes through. The funds land in a wallet you've never seen. The blockchain records everything, but that doesn't help you get your money back. In this campaign, the attackers didn't need to compromise any inboxes. They just needed to get their malware onto a device, often through a fake browser extension or a trojanized software update. Once installed, the malware sat quietly, waiting for the exact moment you copied a crypto address. What's particularly nasty about clipboard hijacking is that it bypasses your own verification habits. Most people check the first and last few characters of an address. The malware knows this. It generates a lookalike address that matches those visible parts. Your eyes tell you it's correct. The blockchain tells a different story. ### Why These Attacks Are So Dangerous Both chains share a common thread: they exploit the gap between what we see and what's actually happening. We trust our eyes, our email clients, and our browsers. These attacks turn those trusted tools against us. - Real emails mean no suspicious links to spot - Browser manipulation means no obvious red flags on screen - Clipboard hijacking means your own copy-and-paste is compromised - Traditional security training often doesn't cover these specific tactics ### What You Can Do to Protect Yourself You can't rely on vigilance alone. These attacks are designed to defeat it. Instead, you need to build layers of verification that don't depend on what you see on a screen. - **Use out-of-band confirmation:** For large payments, confirm the details through a phone call or a separate device. - **Check the full address:** For crypto, always verify the entire wallet address, not just the beginning and end. - **Keep software updated:** Both attacks relied on malware that could have been prevented with timely patches. - **Use dedicated devices:** Consider using a separate, locked-down device for high-value financial transactions. - **Monitor your inboxes:** If you suspect a compromise, change passwords immediately and review forwarding rules. ### The Bottom Line These attack chains are a reminder that security is not a single action. It's a continuous process of questioning what you see. The emails were real. The payments were hijacked. The only defense is to build friction into your own workflow, making it harder for attackers to move silently. Don't wait for the next threat report to be about you. Take a few minutes today to review your payment verification process. It might be the most valuable time you spend this month.