Storm-2561 Uses Fake VPN Clients and SEO poisoning to Steal Enterprise Credentials

Du'aine Davis

Observed in the wild

• In mid‑January 2026, Microsoft identified a credential‑theft campaign targeting users searching for legitimate enterprise VPN software. UK and global organisations were impacted as employees downloaded fake VPN installers that harvested VPN credentials. Activity is attributed to financially motivated threat actor Storm‑2561, active since at least May 2025.
• Storm‑2561 abused SEO poisoning to push spoofed VPN websites to the top of search results, redirecting victims to malicious GitHub‑hosted ZIP files. These contained digitally signed MSI installers that side‑loaded malicious DLLs (Hyrax infostealer), mimicked legitimate VPN clients, captured credentials via fake login prompts, and exfiltrated data to attacker‑controlled infrastructure.
• Organisations are advised to enable Microsoft Defender cloud‑delivered protection, EDR in block mode, network and web protection, and SmartScreen. Enforce MFA across all access and proactively ingest the published IOCs into Microsoft Defender XDR. Security teams should hunt for VPN executables loading unexpected DLLs, signed binaries from unusual publishers, and Defender alerts associated with Hyrax infostealer activity, DLL side‑loading, and anomalous VPN execution.

Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft | Microsoft Security Blog