Attackers Use SEO Poisoning and Signed Trojans to Steal VPN Credentials

A financially motivated threat actor known as Storm-2561 has been running a credential theft campaign since May 2025, manipulating search engine rankings to push fake VPN software toward enterprise users.

The campaign targets employees searching for tools such as Pulse Secure, Fortinet, and Ivanti, redirecting them to spoofed websites that serve malicious download packages.

Once the victim installs the fake software, it silently harvests VPN credentials and sends them to attacker-controlled servers without triggering any visible warning.​

Storm-2561 manipulates SEO to push fraudulent websites to the top of search results for queries like “Pulse VPN download” or “Pulse Secure client.”

Users who click these results land on pages built to look identical to real VPN vendor portals, complete with matching logos and download buttons.

The malicious ZIP files were hosted on GitHub repositories, which have since been removed.

The trojans were digitally signed by a certificate issued to “Taiyuan Lihua Near Information Technology Co., Ltd.” — a certificate that has since been revoked.​

Microsoft Defender Experts identified the campaign in mid-January 2026, attributing it to Storm-2561 as part of a known pattern of malware distribution through SEO abuse and software impersonation.

Microsoft Threat Intelligence analysts noted that this activity aligns with the financially driven behavior this group has demonstrated since at least May 2025.

Pairing realistic spoofed websites with legitimate-looking digital signatures reflects a deliberate effort to lower user suspicion and extend the campaign’s reach.​

What makes this threat particularly hard to detect is what happens right after credential theft. The fake VPN client displays a convincing error message, then directs the victim to download the real VPN software from the official vendor website.

If the legitimate client installs and connects normally, the victim has no reason to suspect their credentials were already taken. There are no visible signs of compromise, and most victims remain completely unaware.​

The broader impact falls on enterprise organizations that depend on VPN access for remote operations. Stolen credentials enable lateral movement across corporate networks, unauthorized data access, and more destructive follow-on attacks.

Since this campaign imitates multiple trusted VPN brands, the victim pool extends across many industries and regions.​

Inside the Infection Mechanism

The attack delivers its payload through a Windows Installer (MSI) package hidden inside a ZIP file.

When a victim runs the fake MSI — disguised as a Pulse Secure installer — it drops Pulse.exe alongside two malicious DLL files, dwmapi.dll and inspector.dll, all installed under %CommonFiles%Pulse Secure to closely mimic a legitimate installation path.

The dwmapi.dll file works as an in-memory loader, executing shellcode that loads inspector.dll — a variant of the Hyrax infostealer.

Hyrax captures VPN credentials entered through the fake login screen and reads stored configuration data from C:ProgramDataPulse SecureConnectionStoreconnectionstore.dat, sending everything to 194.76.226[.]93:8080. 

To maintain persistence, the malware adds Pulse.exe to the Windows RunOnce registry key, making it run automatically on every device restart.​

The digital signatures on these malicious files allowed them to bypass standard Windows security warnings and certain application allowlisting policies. 

Microsoft found additional files carrying the same certificate, including fake installers for GlobalProtect VPN and Sophos Connect, showing that the campaign extends well beyond a single impersonated brand.​

To reduce risk from this threat, users should only download software directly from official vendor websites and avoid download links served through search results.

Enforcing multi-factor authentication on all accounts is critical, since stolen VPN passwords alone cannot grant access when MFA is in place.

Organizations should run endpoint detection and response tools in block mode, enable both network and web protection, and apply attack surface reduction rules to block untrusted executables.

Employees should not store enterprise credentials in browsers, and security teams should investigate any files signed by unrecognized or recently revoked certificate authorities.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.