eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th)

Multiple ISC diary entries highlight active e-banking phishing and malware delivery techniques. Key items: (1) An eBanking phishing campaign targeting a major Belgian bank uses IPv4-mapped IPv6 addresses (obfuscated IPv4-in-IPv6 notation) to deliver phishing URLs and evade detection. (2) A malicious ZIP (SHA256 a0104921a2d37ab87482ac9a9f5c3713479c118846c3e999178e75b81620c094) contains a VHDX that auto-mounts on modern Windows and exposes a malicious JavaScript which ultimately delivers the Remcos RAT. Additional diary topics cover image-based malware steganography (Evil MSI Background), trends