New ZipLine campaign targets critical manufacturing firms with in-memory MixShell malware

Check Point Research has uncovered a highly persistent phishing operation dubbed ZipLine, which reverses traditional attack vectors by exploiting victims’ own “Contact Us” web forms to initiate seemingly legitimate business communications.

Targeting primarily U.S.-based manufacturing companies in supply chain-critical sectors, the campaign leverages prolonged email exchanges often spanning weeks to build trust before delivering malicious ZIP archives.

Attackers pose as potential partners, discussing non-disclosure agreements (NDAs) or, in recent waves, AI transformation initiatives framed as internal “AI Impact Assessments” to solicit victim input on operational efficiencies.

Read more at GB Hackers