Microsoft's threat teams have uncovered a slick credential-theft operation that's been running since mid-January 2026, where attackers trick people searching for legitimate enterprise VPN software into downloading trojanized installers instead.
Who do you think is responsible? A financially driven group, Storm-2561, that has operated since May 2025 and routinely employs SEO poisoning to manipulate the results returned by search engines (particularly Bing), thus directing users searching for tools from vendors such as Ivanti (Pulse Secure), Cisco, Fortinet, SonicWall, etc. to fake download pages at or near the top of their search results.
The process is simple in appearance yet highly successful at obtaining the desired outcome:
1. User searches something like “Pulse VPN download” or “Ivanti Secure Access client.”
2. Malicious sites (e.g., ivanti-vpn[.]org or vpn-fortinet[.]com) rank high and redirect to attacker- 2. Sites like ivanti-vpn[.]org and vpn-fortinet[.]com have high rankings on search engines and will redirect users to attacker controlled GitHub repositories.
3. GitHub contains ZIP files containing MSI files signed by an expired certificate issued by Taiyuan Lihua Near Information Technology Co., Ltd. for the purpose of bypassing basic validation checks.
4. Fake VPN applications drop malicious DLLs, such as the malware dwmapi.dll and inspector.dll, which is a version of the Hyrax infostealer, onto victim systems as part of their_installation process.
5. The fake VPN client will provide a convincing-looking sign-in dialog that will capture a victim's VPN username and password (and their configuration data, including the contents of the 'connectionsstore.dat' file), and then display an 'error' message to make the victim believe there was just a bad installation and they did not get compromised.
6. Persistence is achieved by using the "RunOnce" registry key, so after a victim reboots their PC, the malware will run again. The credentials are sent to the attackers' C&C (Command & Control) servers, which may allow them access to the corporate network through stolen VPN credentials.
Microsoft attributes this squarely to Storm-2561, noting the financial motivation and reuse of tactics like vendor impersonation and trusted-platform abuse (GitHub in this case). They've already taken down the malicious repos and revoked the signing cert to disrupt things.
The 2026 version of these campaigns, which have already been featured in Cyjax and Zscaler reports published in January and February of 2025 respectively, has enhanced the social engineering tip by creating a more streamlined means of obtaining credentials (via a quick grab), establishing a believable cover story, and generating very little suspicion.
For enterprises or individuals using enterprise VPNs:
1. Only download from official vendor websites or application stores (not through third-party search engine results).
2. Implement multi-factor authentication (MFA) on an organization-wide basis, particularly for VPN gateways and cloud-based accounts.
3. Train employees in how to recognize common red flags such as an urgent "update" request, an unusually-named domain, or an install that fails for suspicious reasons.
4. Monitor for anomalous VPN logins and atypical outbound data traffic from client devices.
5. Keep endpoint protection up to date, Microsoft Defender and similar tools flag these behaviors.
It's a reminder that in cybersecurity, trust in search rankings and software branding can be weaponized fast. When someone's desperately trying to connect remotely or fix a work VPN, a poisoned result feels like a lifeline, until it's not. If your team uses these tools, a quick reminder about safe downloading habits could save a lot of cleanup later.
Source: The Hacker News
