'ZipLine' Phishers Flip Script as Victims Email First

**Executive summary:** The ZipLine campaign is a financially motivated phishing operation that engineers targets to initiate contact via corporate 'Contact Us' forms, builds credibility over weeks, and ultimately delivers weaponized ZIP archives containing a malicious LNK which launches an in-memory PowerShell implant (MixShell) that provides persistence and command-and-control; attackers leverage abandoned/dormant legitimate domains and Heroku hosting to evade detection and target industrial, hardware, semiconductor, biotech, and other supply-chain-critical organizations.