From a VHDX File to a Remcos RAT, (Tue, Jun 16th)

SANS ISC reports a recent malicious ZIP (SHA256 a0104921...) that contains a VHDX file which, when mounted automatically on modern Windows systems, exposes a malicious JavaScript that leads to deployment of the Remcos RAT. The feed also highlights the June 2026 Microsoft Patch Tuesday: 204 vulnerabilities patched (38 critical), three previously disclosed, six affecting Microsoft cloud services with no user action required, and ~360 Chromium vulnerabilities incorporated into Edge. Relevant operational actions are to block/detect malicious VHDX/ZIP delivery vectors, disable unsafe auto-mounting/