The Authentic Trap: How H1 2026's Scam Campaigns Learned to Borrow Trust Instead of Faking It- 305

August 15, 2026

Security vendors publish threat reports constantly, and most of them read the same way: a pie chart of malware categories, a ranked list of the quarter's biggest campaigns, a plea to patch and train employees. Gen's account of the first half of 2026 buries a more interesting claim beneath its own topline numbers — that scams, account takeovers, malicious software packages, and AI agents are no longer succeeding by breaking into systems so much as by moving into the space immediately next to the systems, workflows, and permissions people already trust and use every day. Two investigations from the same reporting period make that claim concrete, and both share a detail that matters more than either campaign's specific payload: in neither case did the attacker forge or fake the underlying system at all. They borrowed it.

The report's aggregate numbers establish the scale before the mechanics come into view. Scams accounted for 46 percent of everything Gen's telemetry identified as a threat in the first half of the year, with malvertising close behind at 30 percent, and the company says it blocked 114.2 million e-commerce scams and 20.3 million tech-support scams over the period. Numbers at that scale are useful for establishing volume, but they collapse an enormous range of distinct techniques into a small number of categories — a single "e-commerce scam" tally says nothing about how a fake storefront becomes a script execution on a victim's machine, how that script becomes a silently modified browser proxy setting, or how a cryptocurrency wallet address gets swapped in the moment before a victim confirms a transaction. Gen's own two featured investigations from the period exist to fill in exactly that gap, and both turn out to describe the same underlying strategy from different angles.

The first is a banking-malware campaign that targeted users across Lithuania, Poland, Slovakia, and Czechia using what looked, on the surface, like entirely ordinary business correspondence — invoice notices, scanned-document verification requests, shipment confirmations, the standard vocabulary of B2B email. What made the campaign effective wasn't a convincing forgery of that vocabulary; it was that the emails were not forged at all. They were sent from corporate mailboxes the attackers had already compromised, meaning the messages passed through genuinely authorized infrastructure with a real sending history behind them. That single fact defeats two of the standard email-authentication defenses at once: DKIM and SPF checks, which verify that a message actually originated from infrastructure authorized to send on a domain's behalf, pass cleanly, because the message genuinely did originate there — there was no spoofing to catch. And reputation-based filtering, which flags senders with a history of suspicious behavior, has nothing to flag, because the compromised account's sending history is entirely legitimate up until the moment it wasn't. Once a recipient opened the attachment, a JavaScript dropper launched a chain of PowerShell stages that eventually delivered banking-specific functionality and shellcode — investigators point to indicators consistent with a malware family tracked as GepyS — which altered the victim's browser proxy settings and installed a malicious browser extension, positioning itself directly alongside the victim's own online banking session rather than needing to intercept it from any greater distance.

The second investigation targets cryptocurrency users with a different mechanism aimed at the same underlying principle. A Rust-based piece of malware known as a clipper works by monitoring a victim's clipboard and silently substituting the attacker's own wallet address the moment it detects a copied cryptocurrency address, so that a victim who believes they are pasting a trusted recipient's address into a transaction is actually pasting the attacker's. What distinguishes this particular campaign is where it got its instructions: rather than relying on a conventional command-and-control server that defenders could identify and block, the malware retrieved its C2 infrastructure pointers from data embedded in transactions on the Binance Smart Chain, treating a public, permanent, and difficult-to-take-down blockchain ledger as a resilient hosting layer for its own configuration. Once the substitution happens, the transaction that actually executes is entirely genuine from the blockchain's perspective — the ledger faithfully records a real, valid transfer to a real address, because nothing about the blockchain itself was tampered with. The deception occurred earlier and entirely on the victim's own machine, at the moment of copying and pasting, long before the transaction ever reached the chain that would go on to record it with complete technical accuracy.

Set side by side, the two campaigns describe the same shift Gen's own framing points toward, arrived at through opposite technical routes. The banking campaign hijacks a genuinely trusted sender rather than impersonating one; the clipper campaign lets a genuinely trustworthy ledger record a transaction rather than attacking the ledger's integrity at all. Neither had to defeat the actual security properties of the systems involved — corporate email authentication worked exactly as designed, and the Binance Smart Chain recorded exactly what it was asked to record. What both campaigns defeated instead was the assumption sitting just outside those systems: that a message from an authenticated, reputable sender reflects that sender's intent, and that a wallet address a user believes they copied is the address that actually gets pasted. Gen's broader case, made across scam categories that together account for nearly half of everything its telemetry identified in the period, is that this is no longer an edge case confined to sophisticated banking trojans and blockchain-savvy clippers — it is becoming the default shape of a scam, precisely because attacking the trust sitting around a system is now consistently easier than attacking the system itself.