Security

Storm-2561 VPN Fake Installers via SEO Poisoning

3 min read

Summary

Microsoft says the Storm-2561 threat group is using SEO poisoning and fake vendor-branded download pages to trick users searching for VPN software into installing trojanized clients. The campaign matters because the malware steals VPN credentials and configuration data, uses GitHub-hosted payloads and a legitimate code-signing certificate to appear trustworthy, and could give attackers a stealthy path into enterprise networks.

Need help with Security?Talk to an Expert

Introduction

Microsoft Threat Intelligence has detailed a new Storm-2561 campaign that should be on every security team’s radar. By abusing search engine rankings, fake vendor-branded websites, and even valid code-signing certificates, the attackers are targeting users looking for trusted enterprise VPN software and stealing credentials before many organizations realize anything went wrong.

What’s new

Storm-2561 is distributing trojanized VPN installers through a convincing attack chain:

  • Users search for legitimate VPN software such as Pulse Secure or Fortinet clients.
  • Malicious, SEO-poisoned sites appear in search results and imitate trusted vendor download pages.
  • Victims are redirected to ZIP files hosted on attacker-controlled GitHub repositories.
  • The ZIP contains a malicious MSI installer and DLLs that mimic a real VPN deployment.
  • The installer drops Pulse.exe and side-loads malicious DLLs including dwmapi.dll and inspector.dll.
  • inspector.dll is identified as a variant of the Hyrax infostealer, which extracts VPN credentials and configuration data.

Microsoft also noted that the malware was signed with a legitimate certificate from “Taiyuan Lihua Near Information Technology Co., Ltd.” That certificate has since been revoked, but the use of valid signing reduced user suspicion and may have helped evade some defenses.

Attack behavior to know

The fake VPN client presents a realistic sign-in interface to capture credentials directly from the user. After submission:

  • A fake installation or login failure is shown
  • The user is prompted to download the real VPN client
  • In some cases, the browser is opened to the legitimate vendor site

This post-compromise redirection is especially effective because users may later install the real software successfully and never suspect their credentials were already stolen.

The campaign also establishes persistence through the Windows RunOnce registry key and exfiltrates stolen data to attacker-controlled infrastructure.

Impact on IT administrators

For IT and security teams, this campaign highlights a growing risk: users no longer need to open phishing email attachments to be compromised. Simply searching for business software can lead to credential theft.

Organizations with remote access dependencies should be particularly concerned because stolen VPN credentials can enable unauthorized access, lateral movement, and follow-on attacks. The use of spoofed software branding and signed malware also increases the chance that end users will trust the installer.

Administrators should take the following steps:

  • Ensure Microsoft Defender Antivirus cloud-delivered protection is enabled
  • Run EDR in block mode where supported
  • Hunt for suspicious VPN-related installers, DLL side-loading, and RunOnce persistence
  • Review outbound connections to known indicators and suspicious GitHub-hosted downloads
  • Educate users to download VPN software only from approved corporate portals or vendor-verified sources
  • Reset credentials and investigate devices if users report failed VPN installs followed by successful reinstallation

This is a strong reminder that search results can be part of the attack surface, and software trust signals alone are no longer enough.

Need help with Security?

Our experts can help you implement and optimize your Microsoft solutions.

Talk to an Expert

Stay updated on Microsoft technologies

Read the original article by Microsoft Threat Intelligence and Microsoft Defender Experts
SecurityMicrosoft Defendercredential theftSEO poisoningVPN malware

Related Posts

Security

macOS ClickFix Campaign Hides Behind Fingerprinting

Microsoft Threat Intelligence reports that a macOS ClickFix campaign has shifted from openly serving malicious lures to using server-side browser fingerprinting that mainly exposes the payload to likely macOS victims. The change makes the operation harder for crawlers, sandboxes, and defenders to spot, increasing the importance of hunting for shared infrastructure patterns and strengthening endpoint protections.

Security

Microsoft CNAPP Leader: KuppingerCole 2026 Report

Microsoft has been named a Leader across all four categories in KuppingerCole’s 2026 CNAPP Leadership Compass, highlighting Defender for Cloud’s unified approach to cloud and AI security. The recognition matters for security teams as CNAPP platforms increasingly focus on exploitability, attack path analysis, AI security posture, and integrated SOC operations across multicloud environments.

Security

ChainDrop npm Attack: Self-Propagating Worm Explained

Microsoft has detailed ChainDrop, a large-scale npm supply chain attack that compromised more than 400 packages using a self-propagating credential-stealing worm. The campaign matters because it targets developer workstations and CI/CD pipelines, steals cloud and publishing credentials, and can automatically republish infected packages across additional publishers.

Security

Microsoft Defender Device Isolation Stops Ransomware

Microsoft Defender’s attack disruption now includes automatic device isolation for compromised endpoints, adding a new containment layer beyond user-based response. In a published QNET case study, Defender isolated an endpoint in 128 seconds, stopping a multi-stage ransomware-related attack before persistence, credential theft, or lateral movement could occur.

Security

Zero Trust for AI: New Microsoft Security Tools

Microsoft has expanded its Zero Trust for AI strategy with new assessment capabilities, a DevSecOps pillar in the Zero Trust Workshop, and practical implementation guidance. The updates help security and platform teams assess AI-related risk, secure AI-assisted development, and build a phased roadmap for adopting Zero Trust controls across AI systems.

Security

CaptiveCrunch Malware Campaign Targets Travelers

Microsoft has disclosed CaptiveCrunch, an active campaign linked to Midnight Blizzard that hijacks traffic on hospitality and captive portal networks to steal credentials and deliver malware. The threat is especially relevant for organizations with frequent travelers because attackers are abusing Entra ID device code flows, fake update prompts, and adversary-in-the-middle phishing to compromise corporate accounts and endpoints.