Back Gbhackers

Storm-2561 Uses SEO Poisoning, Fake Signed VPN Apps to Steal Enterprise Credentials

Gbhackers •Mayura Kathir • March 13, 2026

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Storm-2561 Targets VPN Users with SEO Poisoning and Fake Clients Cybercriminal group Storm-2561 is exploiting SEO poisoning to distribute trojanized VPN clients, primarily targeting enterprise users of popular VPN solutions like Pulse Secure, Ivanti, and Cisco. The attackers manipulate search engine results to redirect users to spoofed sites that closely mimic legitimate VPN vendors, leading to the download of a malicious ZIP file containing a fake MSI installer. This installer drops a fake application and a variant of the Hyrax infostealer, which captures and exfiltrates VPN credentials and configuration data. The malware is signed with a valid certificate from Taiyuan Lihua Near Information Technology Co., Ltd., allowing it to bypass security warnings. Microsoft first detected this activity in January 2026, although the group has been active since May 2025. The campaign highlights the increasing sophistication of infostealers, which are now often paired with remote access trojans. Microsoft has provided mitigation guidance and indicators of compromise to help organizations defend against this threat. 9 sources 71

Storm-2561 Uses SEO Poisoning, Fake Signed VPN Apps to Steal Enterprise Credentials

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)