Microsoft Uncovers Storm2561 VPN Credential Theft Campaign

Microsoft security researchers have uncovered a credential theft campaign run by the financially motivated threat actor Storm2561, which uses search engine optimization poisoning to distribute fake enterprise VPN installers and steal user credentials. The operation, active since May 2025 and detected in mid-January 2026, targets individuals searching for legitimate VPN software from vendors including Ivanti, Cisco, and Fortinet.

The campaign begins with attackers manipulating search results for queries such as "Pulse Secure client" or "Pulse VPN download" on engines like Bing. These poisoned results direct users to spoofed websites, such as vpnfortinet.com and ivantivpn.org, that mimic official vendor pages. From there, victims are linked to now-defunct GitHub repositories hosting ZIP archives containing trojanized MSI installers disguised as trusted VPN clients.

When executed, the MSI deploys files under paths resembling legitimate installations, such as CommonFilesPulse Secure. It drops Pulse.exe, a fake application, along with malicious DLLs including dwmapi.dll, which serves as an in-memory loader, and inspector.dll, a variant of the Hyrax information-stealing malware. The...