Ethical Hacking News
Storm-2561 has been linked to a Trojan VPN client campaign via SEO poisoning, which redirects users searching for legitimate enterprise software to fake sites where they download digitally signed trojans that masquerade as trusted VPN clients while harvesting VPN credentials.
Storm-2561 is a malicious entity exploiting SEO poisoning techniques to spread Trojan VPN clients and steal credentials. Microsoft has linked Storm-2561 to a credential theft campaign using fake VPN clients distributed through malicious ZIP files. The use of SEO poisoning allows threat actors to exploit trust in search engine rankings and software branding as a social engineering tactic. Storm-2561 is a persistent threat actor that continues to evolve its tactics to evade detection. The campaign involved redirecting users searching for legitimate enterprise software to fake sites, where they were tricked into downloading digitally signed trojans. A fake VPN sign-in dialog was displayed to capture credentials, and legitimate certificates were revoked to neutralize the operation.
In an era where cybersecurity threats are evolving at an unprecedented pace, a new actor has emerged to join the ranks of notorious threat actors. Meet Storm-2561, a malicious entity that has been exploiting search engine optimization (SEO) poisoning techniques to spread Trojan VPN clients and steal sensitive credentials from unsuspecting users.
According to recent reports from Microsoft, Storm-2561 has been linked to a credential theft campaign that involves fake virtual private network (VPN) clients distributed through malicious ZIP files on attacker-controlled websites. The campaign redirects users searching for legitimate enterprise software to these fake sites, where they are tricked into downloading digitally signed trojans that masquerade as trusted VPN clients while harvesting VPN credentials.
The use of SEO poisoning techniques by Storm-2561 is a striking example of how threat actors can exploit trust in search engine rankings and software branding as a social engineering tactic. This method allows them to capitalize on the good faith of users looking for enterprise VPN software, thereby increasing their chances of successfully tricking victims into divulging sensitive information.
The Microsoft Threat Intelligence and Microsoft Defender Experts teams have attributed this campaign to Storm-2561, a threat activity cluster known for propagating malware through SEO poisoning and impersonating popular software vendors since May 2025. This connection highlights the persistence and adaptability of Storm-2561 as a threat actor, who continues to evolve its tactics to evade detection.
The campaign observed by Microsoft was first documented by Cyjax, which highlighted the use of SEO poisoning to redirect users searching for software programs from companies like SonicWall, Hanwha Vision, and Pulse Secure (now Ivanti Secure Access) on Bing to fake sites. A subsequent iteration of the attack was disclosed by Zscaler in October 2025, which observed taking advantage of users searching for legitimate software on Bing to propagate a trojanized Ivanti Pulse Secure VPN client via bogus websites ("ivanti-vpn[.]org") that ultimately stole VPN credentials from the victim's machine.
The abuse of trusted platforms like GitHub to host the installer files used in this campaign is particularly noteworthy. Specifically, the GitHub repository hosts a ZIP file containing an MSI installer file that masquerades as legitimate VPN software but sideloads malicious DLL files during installation. The end goal, as before, is to collect and exfiltrate VPN credentials using a variant of an information stealer called Hyrax.
A fake, yet convincing, VPN sign-in dialog is displayed to the user to capture the credentials. Once the information is entered by the victim, they are displayed an error message and are instructed to download the legitimate VPN client this time. In some cases, they are redirected to the legitimate VPN website.
Microsoft has since taken down the attacker-controlled GitHub repositories and revoked the legitimate certificate to neutralize the operation.
To counter such threats, organizations and users are advised to implement multi-factor authentication (MFA) on all accounts, exercise caution when downloading software from websites, and ensure that they are authentic. This is a critical step in preventing successful phishing attacks and protecting sensitive information.
Related Information:
https://www.ethicalhackingnews.com/articles/Storm-2561-The-Lurking-Threat-Actor-Behind-a-Trojan-VPN-Client-Campaign-via-SEO-Poisoning-ehn.shtml
https://thehackernews.com/2026/03/storm-2561-spreads-trojan-vpn-clients.html
https://www.microsoft.com/en-us/security/blog/2026/03/12/storm-2561-uses-seo-poisoning-to-distribute-fake-vpn-clients-for-credential-theft/
Published: Fri Mar 13 10:22:44 2026 by llama3.2 3B Q4_K_M
