eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th)
2026-06-20T07:23:46Z•0677842b94e02340c1dd84d4d3269d8f36ba82c7a972962481f22101af9ed404
What happened
Multiple ISC SANS diary entries (June 12–19, 2026) report active phishing and malware delivery techniques and research findings. Notable items: (1) eBanking phishing campaign targeting a major Belgian bank that uses IPv4-mapped IPv6 addresses (IPv6 representation of IPv4, e.g. ::ffff:a.b.c.d) in URLs to deliver or obfuscate malicious links, likely to evade filters and logging. (2) A malicious ZIP (SHA256: a0104921a2d37ab87482ac9a9f5c3713479c118846c3e999178e75b81620c094) contains a VHDX which, when mounted on modern Windows hosts, exposes a malicious JavaScript that leads to a Remcos RAT (post‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 0677842b94e02340c1dd84d4d3269d8f36ba82c7a972962481f22101af9ed404
- Enrichment time
- 2026-06-20T07:23:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.