Gen Digital, the company behind Norton and Avast, published its H1 2026 Threat Report this month, and buried inside it is an attack chain that deserves more attention than a single line item. Researchers documented a banking-malware campaign running across Czechia, Slovakia, and Poland that delivers its first-stage payload through emails dressed up as shipment notices, scanned-document alerts, and invoices. In some cases, those emails came from mailboxes that were not spoofed at all. They were real corporate accounts, already compromised, sending real mail through infrastructure that was always authorized to send it. Every authentication check a receiving server can run comes back clean, because nothing about the sender was ever forged.
How the Chain Actually Runs
The attack starts with what looks like ordinary business correspondence: an invoice attachment, a shipping confirmation, a scanned document notification. Opening the attachment triggers a JavaScript dropper, which pulls down a series of PowerShell stages, which in turn load shellcode onto the machine. The final payload does not try to steal a password directly. It modifies the victim’s proxy settings and installs malicious browser add-ons, positioning itself to intercept the victim’s own online banking session the next time they log in. The victim authenticates normally, and the malware watches, or redirects, from inside the browser.
Compromised mailbox, JavaScript dropper, PowerShell staging, shellcode loader, proxy and browser manipulation. Five links, and the first one is the only part of the chain email security tooling gets a real look at.
Why the Compromised Mailbox Is the Whole Point
Business correspondence lures work because they exploit an existing trust relationship, and that trust is strongest when the email genuinely comes from where it claims to. Gen’s researchers noted this directly: messages sent from compromised corporate mailboxes looked legitimate not just to the humans reading them, but to the email security systems inspecting them. A gateway checking SPF, DKIM, and DMARC alignment on one of these messages finds exactly what it expects to find, because the domain really did send it. There is no lookalike, no display-name trick, no homograph. The account itself is the vulnerability, and once it is compromised, the attacker inherits every bit of authentication trust that account was ever granted.
This is a different failure mode than the vendor-invoice fraud that has dominated BEC headlines this year. There, the payoff is a redirected wire transfer. Here, the payoff is malware installation, using the same access, the same authenticated channel, and the same blind spot.
A Second Chain, Same Underlying Theme
The report’s other headline finding is a Rust-compiled clipboard hijacker that monitors copied text for cryptocurrency wallet addresses across 21 blockchain types, including BTC, ETH, and LTC, and silently swaps in an attacker-controlled address the moment it spots one. The victim copies an address, pastes it, and approves what looks like a completely normal transaction. It is a different delivery path than the banking-malware chain, but it shares the report’s larger thesis: attackers are increasingly building attacks around the parts of a workflow that people trust automatically, whether that is a familiar sender’s mailbox or their own clipboard.
The scale behind both findings is not small. Scams accounted for nearly 46% of all Gen threat detections in H1 2026, with malvertising responsible for close to another 30%. The company blocked 114.2 million e-shop scam attempts and 20.3 million tech support scam attempts in the same period. Separately, Gen identified more than 15.7 million breached records containing email addresses, and logged 18,618 breach events affecting its customers, up 94.5% from the second half of 2025. Norton and LifeLock breach-notification alerts with an attributed leak source rose 628.1%, reaching 3.3 million, out of more than 10 million total breach notifications sent. Every one of those breached credentials and mailboxes is a potential entry point for exactly the kind of campaign described above.
Why DMARC Has Nothing to Say About Any of This
DMARC exists to answer one question: was the domain in the From header authorized to send this message. When the answer is genuinely yes, because the sending mailbox belongs to that domain and was simply taken over by an attacker, DMARC has nothing left to flag. SPF passes because the mail really did originate from the domain’s authorized infrastructure. DKIM passes because it was signed with the domain’s real private key, inside its real mail system. Alignment passes because there was never any mismatch to catch. This is not a gap in how DMARC is configured. It is the edge of what the protocol was designed to check in the first place: the authorization of sending infrastructure, not the integrity of the human or account using it.
What This Means for Your Program
Treat account takeover, not just domain spoofing, as a DMARC-adjacent risk. A domain at p=reject stops outsiders from forging your mail. It does nothing if an insider’s mailbox is compromised and used to send real mail from a real account. Credential hygiene and mailbox-level anomaly detection sit outside DMARC but belong in the same conversation.
Watch for sending-behavior anomalies inside authenticated mail, not just failures. A mailbox that suddenly starts sending invoice-themed attachments to contacts it has never emailed before is a signal, even though every authentication check it triggers comes back green. Behavioral monitoring on your own mail flow catches what protocol-level checks structurally cannot.
Sandbox attachments on invoice, shipping, and scanned-document lures specifically. These three pretexts carried this entire campaign because they are common enough to lower a reader’s guard. Static or dynamic analysis of attachments from these categories, regardless of sender reputation, adds a layer authentication cannot provide.
Assume any credential exposed in a breach could become a mailbox compromise. With Gen logging tens of thousands of breach events and millions of newly exposed records in H1 2026 alone, the raw material for this kind of campaign keeps growing. Enforce credential rotation and multi-factor authentication on mailbox access as a baseline, not an afterthought.
Keep DMARC enforced at reject regardless. It remains the correct, necessary defense against domain impersonation, and this campaign does not change that. It simply operates one layer beneath where DMARC looks, which is exactly why it needs a different set of controls sitting alongside authentication, not instead of it.
The Takeaway
The attackers behind this campaign did not need to beat DMARC. They walked around it, by taking over an account DMARC was already correctly trusting. As mailbox compromise becomes a delivery mechanism for malware, not just a vehicle for one-off wire fraud, the gap between “this email is authenticated” and “this email is safe” keeps widening. Authentication tells you the domain is real. It was never going to tell you the account behind it is still in the hands of the person who owns it.
Excello Mail gives you continuous visibility into your DMARC enforcement and every source authorized to send under your domain, so your authentication posture stays strong while your team builds the account-level defenses that catch what DMARC structurally cannot. Sign up for free to Excello Mail and see exactly who is sending as you, all the time.