eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th)

This SANS ISC diary batch highlights several active threats and defensive blind spots: a phishing campaign targeting a major Belgian bank that uses IPv4-mapped IPv6 addresses for delivery/obfuscation; a malicious ZIP (SHA256 a0104921a2d37ab87482ac9a9f5c3713479c118846c3e999178e75b81620c094) containing a VHDX that auto-mounts on modern Windows and exposes malicious JavaScript which leads to a Remcos RAT; ongoing analysis of malicious MSI/image techniques ("Evil MSI Background") and BASE64 image payloads; and telemetry on coordinated SSH brute‑force activity and browser-based security tool blind‑