Trojan VPN Clients Spread via SEO Poisoning: Storm‑2561’s Credential Theft Campaign

Microsoft has uncovered a credential theft campaign by threat actor Storm‑2561, which uses SEO poisoning to distribute trojanized VPN clients. The operation targets users searching for legitimate enterprise VPN software, redirecting them to attacker‑controlled sites that deploy malware disguised as trusted installers.

How the Attack Works

• SEO poisoning: Malicious sites rank high in search results for VPN software like SonicWall, Ivanti Secure Access, and Hanwha Vision.
• Fake installers: Users download ZIP files containing MSI installers hosted on GitHub, which sideload malicious DLLs.
• Credential theft: A fake VPN login dialog captures credentials, then displays an error and redirects users to the real VPN site.
• Persistence: Malware uses the Windows RunOnce registry key to execute on reboot.
• Payload: A variant of the Hyrax information stealer is used to exfiltrate VPN credentials.

Campaign Timeline

• May 2025: Storm‑2561 begins impersonating software vendors.
• July–September 2024: BlockBlasters game spreads cryptodrainer malware.
• October 2025: Zscaler reports fake Ivanti VPN clients hosted on “ivanti‑vpn[.]org”.
• January 2026: Microsoft observes new activity targeting VPN users.
• March 2026: GitHub repositories taken down; certificates revoked.

Why This Matters

• Trust exploitation: Attackers abuse search engine rankings and software branding to lure victims.
• GitHub abuse: Hosting malware on trusted platforms increases credibility.
• Enterprise risk: VPN credentials are high‑value targets, enabling lateral movement and data exfiltration.

Defensive Recommendations

• Use MFA: Enforce multi‑factor authentication on all VPN accounts.
• Verify sources: Only download software from official vendor domains.
• Monitor RunOnce key: Watch for unauthorized persistence mechanisms.
• Educate users: Train teams to recognize fake login dialogs and suspicious redirects.
• Threat hunting: Scan for Hyrax variants and sideloaded DLLs in VPN directories.

Final Thought

Storm‑2561’s campaign shows how search engines can be weaponized to deliver malware at scale. By blending SEO manipulation, social engineering, and credential theft, attackers are turning trusted VPN brands into attack vectors. For defenders, the lesson is clear: visibility, verification, and vigilance are essential when trust itself becomes the target.