Storm-2561 Spreads Trojan VPN Clients via SEO Poisoning to Steal Credentials

Microsoft has disclosed a credential theft campaign by Storm-2561 using fake VPN clients distributed via SEO poisoning on Bing.

• •Attackers redirect users searching for legitimate enterprise VPN software (SonicWall, Ivanti, Pulse Secure) to malicious ZIP files on attacker-controlled sites
• •The ZIP files contain MSI installers that sideload malicious DLLs and deploy digitally signed trojans masquerading as real VPN clients
• •A fake VPN sign-in dialog captures credentials, then redirects victims to the legitimate VPN site to avoid suspicion
• •The malware, a variant of the Hyrax infostealer, uses the Windows RunOnce registry key for persistence
• •Malicious installer files were hosted on GitHub; Microsoft has since removed the repositories and revoked the signing certificate