Gen's latest threat report details two distinct attack campaigns exploiting compromised email accounts and clipboard manipulation to steal from businesses and cryptocurrency users.
The first attack chain leverages compromised business email inboxes combined with browser manipulation techniques to deliver banking malware. Attackers gain access to legitimate corporate accounts, enabling them to send convincing messages to targets while simultaneously altering browser behavior to intercept or redirect financial transactions.
The second campaign uses clipboard hijacking to reroute cryptocurrency payments. This technique monitors clipboard data—typically containing wallet addresses during transaction setup—and silently replaces legitimate addresses with attacker-controlled ones before users paste payment details.
Both methods exploit user trust in familiar communication channels and routine transaction workflows. The banking malware approach targets enterprise environments with access to larger financial systems, while clipboard hijacking casts a wider net across individual crypto holders.
Organizations should implement email security controls, monitor for unusual browser behavior, and educate users on clipboard risks during payment processes.
Two security researchers purchased commonly-used generic email domains and discovered hundreds of companies automatically sending sensitive corporate data to their listening services. The experiment reveals a widespread failure in email configuration practices across organizations.
Cyberattacks against hedge funds and private equity firms have been attributed to UNC6671, an extortion group connected to the BlackFile threat actors. The campaign represents an escalating threat to the financial sector.
A Go-based malware distributed through ClickFix attacks is targeting macOS users to steal cryptocurrency, passwords, and Apple Keychain data. The infostealer campaign combines social engineering with credential harvesting.
A former NSA official has warned against connecting water infrastructure controllers to the internet following suspected Iranian cyberattacks on U.S. water systems.