eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th)

SANS ISC diary highlights multiple security observations: a targeted eBanking phishing campaign delivered using IPv4-mapped IPv6 addresses (targeting a major Belgian bank) that may be attempting IP-format-based evasion; a malicious ZIP (SHA256 a0104921a2d37ab87482ac9a9f5c3713479c118846c3e999178e75b81620c094) that contains a VHDX which auto-mounts on modern Windows and exposes malicious JavaScript leading to a Remcos RAT infection. Additional entries cover coordinated SSH brute-force behavior, browser-based detection blind spots, statistical analysis of malicious MSI background images, and ISC/