eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th)

SANS ISC diary items (mid‑June 2026) report multiple active threats: an e‑banking phishing campaign that uses IPv4‑mapped IPv6 addresses in URLs to evade detection and target a major Belgian bank; a Malicious ZIP containing a VHDX that auto‑mounts on modern Windows, exposing a JavaScript payload that leads to a Remcos RAT infection; renewed abuse of image/MSI techniques ('Evil MSI Background') for covert payload delivery; and trend analysis of coordinated SSH brute‑force activity plus a guest piece on browser blind spots and how security tools may not be blocking expected web threats.