IPv4 Mapped IPv6 Addresses, (Tue, Mar 17th)
2026-03-18T01:23:51Z•03735c2b6a1001b020353c28d87fa7c3f961b7b16751d5faba040fa9d3d6ab5e
CVE-2026-0866ClickFixEmailJSIPv4-mapped IPv6IoT insecure defaultsRATRFC4038ReactRemcosSmartApeSGZombie Zipcredential theftdefault credentialsmalwareobfuscationphishingproxy abuseproxy scanningvulnerability
What happened
ISC SANS diary (Mar 11–17, 2026) summarizing multiple observed threats and issues: increased /proxy/ URL scans that attempt to abuse proxy forwarding and are using IPv4‑mapped IPv6 addresses (RFC 4038) to obfuscate source; a SmartApeSG campaign delivering the Remcos RAT via a ClickFix page; a React‑based phishing page that exfiltrates credentials using the EmailJS service; IoT devices logging in as admin (default/weak credentials risk); and disclosure of the “Zombie Zip” vulnerability (CVE-2026-0866). These items indicate active credential‑theft/phishing campaigns, commodity RAT distribution,攻
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 03735c2b6a1001b020353c28d87fa7c3f961b7b16751d5faba040fa9d3d6ab5e
- Enrichment time
- 2026-03-18T01:23:51Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.