Storm-2561 Exploits SEO Poisoning to Distribute Fake VPN Clients and Steal Credentials

Microsoft has uncovered a sophisticated credential theft campaign orchestrated by the threat group Storm-2561. The group is leveraging search engine optimization (SEO) poisoning to distribute malicious software disguised as legitimate virtual private network (VPN) clients, putting enterprise and individual users at risk. Microsoft first identified this activity in mid-January 2026.

How the Attack Works

The campaign begins with threat actors manipulating search engine results. When users search for enterprise VPN software, the attackers redirect them to fraudulent websites. These sites host digitally signed trojans that convincingly impersonate trusted VPN clients. Once a user downloads and installs these malicious programs, they are designed to harvest VPN credentials.

Previous Campaigns and Malware Used

This isn’t an isolated incident. Previous iterations of this campaign, documented by security researchers at Cyjax and Zscaler, have targeted users searching for software from vendors like SonicWall, Hanwha Vision and Ivanti Secure Access. These earlier attacks often involved fake installers that deployed malware such as the Bumblebee loader or directly stole credentials.

Storm-2561 also abuses platforms like GitHub to host malicious installer files. These files then deploy a variant of the Hyrax information stealer to exfiltrate sensitive data. Broadcom researchers have linked the Hyrax malware directly to Storm-2561.

Related Threat Activity

Beyond VPN credential theft, Storm-2561 is also involved in other malicious activities. A separate campaign, dubbed “Contagious Interview,” weaponizes job recruitment to target developers. Threat actors pose as recruiters from companies in the cryptocurrency and artificial intelligence sectors to deliver malware.

Microsoft has reported on signed malware impersonating workplace applications, which deploys legitimate Remote Monitoring and Management (RMM) tools to establish persistent access within enterprise environments. This activity demonstrates a sophisticated level of operational security and a focus on long-term access.

Mitigation Strategies

To protect against these threats, organizations and individuals should implement the following measures:

• Enable Multi-Factor Authentication (MFA): MFA adds an extra layer of security, making it significantly harder for attackers to gain access even if they steal credentials.
• Exercise Caution When Downloading Software: Only download software from trusted sources and verify the authenticity of the source before proceeding.
• Verify Software Sources: Double-check the legitimacy of websites and software installers before downloading anything.

Staying vigilant and implementing robust security practices are crucial in defending against the evolving tactics employed by threat actors like Storm-2561.