Storm-2561 pushes fake VPN installers via SEO poisoning to steal enterprise credentials

A credential theft operation uses lookalike VPN download sites and GitHub-hosted ZIPs to drop signed malware that harvests VPN logins and configuration data.

Credential theft | SEO poisoning | Initial access | Infostealer | VPN

Affected vendor / product: Multiple VPN client brands used as lures (Pulse Secure, Fortinet FortiClient, Ivanti, SonicWall NetExtender, Sophos Connect, Palo Alto GlobalProtect, WatchGuard, Check Point, Cisco Secure Client) (microsoft.com)
Primary issue: SEO poisoning leading to trojanised VPN installers and credential exfiltration (microsoft.com)
Exploitation status: Observed in the wild (Microsoft Defender Experts telemetry, mid-January 2026) (microsoft.com)
Confidence level: High (activity, tooling, and IOCs reported by Microsoft); attribution per Microsoft tracking as Storm-2561 (microsoft.com)
Severity: High (enterprise credential theft enabling downstream intrusion) (microsoft.com)
Patch / mitigation status: No software patch; mitigation is policy and control hardening (download hygiene, ASR/EDR, MFA, web filtering) (microsoft.com)

Executive Summary

Microsoft reports a mid-January 2026 credential theft campaign in which users searching for legitimate VPN clients are redirected to attacker-controlled websites positioned via SEO poisoning. (microsoft.com) The lures deliver ZIP archives hosted from GitHub repositories (since removed) that contain MSI installers masquerading as trusted VPN software but side-load malicious DLLs and run signed payloads. (microsoft.com)

The implanted components display a convincing VPN sign-in dialog, capture credentials, and exfiltrate them (alongside stored VPN configuration artefacts) to attacker-controlled infrastructure. (microsoft.com) A key operational detail is post-theft misdirection: victims are told the install failed and are redirected to install the legitimate VPN client, reducing the chance they suspect compromise. (microsoft.com)

Microsoft attributes this activity to Storm-2561, a financially motivated actor it has tracked since May 2025 for SEO-poisoning-driven malware distribution. (microsoft.com)

Context

Storm-2561’s campaign fits an increasingly common “search, click, install” initial access pattern: instead of pushing phishing emails, operators wait for enterprise users to self-select by searching for security and networking tools, then weaponise that trust in search rankings. (microsoft.com)

Independent reporting shows broadly similar SEO poisoning tradecraft being used to distribute trojanised VPN installers and other loaders, including Bing-referrer-dependent content and cloned download sites. (cyjax.com) That matters because credential theft from VPN tooling can become an initial access broker pathway, where stolen remote access credentials are later monetised or used to enable follow-on intrusions. (This is a general risk; Microsoft does not claim a specific follow-on outcome for this activity.) (microsoft.com)

Technical Analysis

1) Initial access: SEO poisoning to spoofed VPN download sites

Microsoft observed the actor abusing SEO to elevate malicious sites for queries such as “Pulse VPN download” and “Pulse Secure client”, with multiple VPN brands spoofed. (microsoft.com)

The reported initial access domains include brand-impersonation infrastructure across several TLDs, including UK and European variants (for example, forticlient.co[.]uk, forticlient-vpn[.]de, sonicwall-netextender[.]nl). (microsoft.com) This aligns with Stage Capabilities: SEO Poisoning (T1608.006). (MITRE ATT&CK)

2) Payload staging and delivery via GitHub-hosted ZIP

Victims clicking “download” were redirected to a GitHub release hosting a ZIP (VPN-CLIENT.zip) containing a malicious MSI. Microsoft states the relevant GitHub repositories were taken down. (microsoft.com)

This behaviour maps cleanly to Stage Capabilities: Upload Malware (T1608.001) and Acquire Infrastructure: Domains (T1583.001). (MITRE ATT&CK)

3) Execution and defence evasion: signed MSI + DLL side-loading

The MSI masquerades as a Pulse Secure installer and drops:

• Pulse.exe plus malicious DLLs (dwmapi.dll, inspector.dll) into a directory structure resembling legitimate Pulse Secure paths (for example %CommonFiles%\Pulse Secure). (microsoft.com)
• A loader chain where dwmapi.dll loads shellcode that in turn loads inspector.dll, described by Microsoft as a Hyrax infostealer variant. (microsoft.com)

The malware and DLLs were digitally signed using a certificate associated with “Taiyuan Lihua Near Information Technology Co., Ltd.”, which Microsoft says has since been revoked. (microsoft.com) This strongly supports Subvert Trust Controls: Code Signing (T1553.002). (MITRE ATT&CK)

The side-loading activity aligns with Hijack Execution Flow: DLL (T1574.001), and the installation path mimicry aligns with Masquerading: Match Legitimate Resource Name or Location (T1036.005). (MITRE ATT&CK)

4) Credential theft workflow and exfiltration

Microsoft reports the fake client presents a credential prompt, captures credentials, and exfiltrates them to attacker-controlled infrastructure, including 194.76.226[.]93:8080. (microsoft.com) The Hyrax component also accesses stored VPN configuration data from C:\ProgramData\Pulse Secure\ConnectionStore\connectionstore.dat. (microsoft.com)

This is consistent with User Execution: Malicious File (T1204.002) and Exfiltration Over C2 Channel (T1041). (MITRE ATT&CK)

5) Persistence and “clean exit” victim deception

Microsoft reports persistence via the Windows RunOnce registry key, configured to execute Pulse.exe on reboot. (microsoft.com) This aligns with Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001). (MITRE ATT&CK)

After stealing credentials, the malware displays an error and instructs the user to install the legitimate VPN client (sometimes opening the real vendor site). If the real client works, users may attribute the earlier failure to a benign issue, reducing reporting and IR trigger likelihood. (microsoft.com)

Impact Assessment

Primary impact: Theft of VPN usernames/passwords and VPN configuration data, enabling unauthorised remote access attempts and follow-on compromise. (microsoft.com)

Operational risk drivers:

• Users may self-remediate by installing the genuine client after compromise, masking the initial infection. (microsoft.com)
• The lure set targets widely deployed enterprise remote access software, so exposure is broad across sectors that rely on VPNs and have staff installing clients. (microsoft.com)

Indicators of Compromise

Detection and hunting guidance

Microsoft lists the following Defender detections associated with the activity:

• Trojan:Win32/Malgent
• TrojanSpy:Win64/Hyrax (microsoft.com)

Microsoft also published hunting queries focused on:

• files signed by the implicated certificate subject, and
• suspicious DLL loads from folders masquerading as Pulse Secure paths. (microsoft.com)

Example (Microsoft Defender XDR Advanced Hunting, as published by Microsoft): (microsoft.com)

let a = DeviceFileCertificateInfo
| where Signer == "Taiyuan Lihua Near Information Technology Co., Ltd."
| distinct SHA1;
DeviceProcessEvents
| where SHA1 in(a)

DeviceImageLoadEvents
| where FolderPath contains "Pulse Secure" and FolderPath contains "Program Files"
  and (FolderPath contains "\\JUNS\\" or FolderPath contains "\\JAMUI\\")
| where FileName has_any("inspector.dll","dwmapi.dll")

MITRE ATT&CK mapping (observed)

Incident Response Guidance

If you suspect exposure (especially endpoints where users recently installed or “reinstalled” VPN clients after an apparent failure), prioritise:

1. Credential containment
   • Treat VPN credentials entered into the fake client as compromised and rotate immediately.
   • Review VPN authentication logs for anomalous access attempts, including from unfamiliar geographies and IPs.
2. Endpoint scoping
   • Hunt for signed artefacts associated with the reported certificate subject and the specific DLL names (dwmapi.dll, inspector.dll) in Pulse Secure-like paths. (microsoft.com)
   • Check for RunOnce persistence entries launching Pulse.exe. (microsoft.com)
3. Network scoping
   • Block and retrospectively search for outbound connections to 194.76.226[.]93:8080, vpn-connection[.]pro, and myconnection[.]pro. (microsoft.com)
   • Add the spoofed domains to web filtering and DNS controls, and monitor for user navigation to brand-impersonation VPN download sites. (microsoft.com)

Mitigation Recommendations

Microsoft’s recommended control set is a good baseline, particularly:

• Enable cloud-delivered protection, EDR in block mode, network protection, and web protection.
• Encourage browsers and controls that enforce site reputation checking (for example SmartScreen).
• Enforce MFA everywhere and remove exceptions; prevent enterprise passwords from being stored or synced in browsers.
• Enable ASR rules that block low-prevalence or untrusted executables. (microsoft.com)

In addition, organisations should:

• Standardise software acquisition: mandate VPN installers come from internal software catalogues, device management, or vendor portals, not search results.
• Restrict installer execution: limit MSI execution to managed workflows, and audit user-driven installs on corporate endpoints.
• Brand impersonation monitoring: track newly registered, lookalike domains for key remote access vendors used in your environment.

Historical Context

This campaign overlaps with broader industry reporting on SEO poisoning used to deliver trojanised installers and loaders. CYJAX documented Bing-referrer-based SEO poisoning chains delivering trojanised MSI packages for multiple software brands, including PulseSecure and SonicWall-themed lures. (cyjax.com) Zscaler separately reported SEO poisoning that delivered a signed, trojanised Ivanti/Pulse Secure-themed VPN installer and targeted connectionstore.dat, similar to the artefact accessed in Microsoft’s reporting. (zscaler.com)

Future Outlook

Expect continued expansion in:

• Brand coverage: more security and IT tooling brands used as lures, especially those frequently searched during incident response or remote onboarding.
• Trust abuse: signed malware, reputable hosting platforms, and post-compromise “legitimisation” steps designed to minimise user suspicion.

Further Reading

• Microsoft analysis of Storm-2561’s fake VPN client credential theft campaign (microsoft.com)
• Zscaler research on spoofed Ivanti VPN client sites and credential theft (zscaler.com)
• CYJAX analysis of Bing SEO poisoning delivering trojanised MSI packages (cyjax.com)
• MITRE ATT&CK: SEO Poisoning (T1608.006) (MITRE ATT&CK)