In mid-January 2026, Microsoft Defender Experts uncovered a credential theft operation orchestrated by the financially motivated threat actor Storm-2561.
Active since May 2025, this group relies heavily on search engine optimization (SEO) poisoning to distribute malware.
By pushing malicious websites to the top of search results for popular enterprise virtual private network (VPN) software, attackers trick users into downloading fake applications.
The campaign specifically targets organizations that rely on remote access, exploiting the implicit trust users place in top search engine results and established software brands.
Attack Chain and Execution
When a user searches for tools like “Pulse Secure client” or “Fortinet,” poisoned SEO rankings direct them to spoofed domains such as vpn-fortinet[.]com or ivanti-vpn[.]org.
Clicking the download link redirects the victim to a now-inactive GitHub repository hosting a malicious ZIP file named VPN-CLIENT.zip.
Inside this archive is a Windows Installer (MSI) masquerading as a legitimate VPN client. When executed, it installs the primary executable alongside two malicious dynamic link libraries (DLLs) in a folder structure mimicking the real software path.
The first DLL, dwmapi.dll, acts as an in-memory loader that triggers the second file, inspector.dll. This second payload is a variant of the Hyrax infostealer.
The malware immediately presents a fake VPN sign-in screen that looks identical to a trusted client.
Once the user enters their credentials, the Hyrax variant harvests the login data and existing VPN configuration files, exfiltrating them to an attacker-controlled command-and-control server.
To maintain persistence, the malware adds itself to the Windows RunOnce registry key so it automatically launches upon system reboot.
![Screenshot from actor-controlled website vpn-fortinet[.]com masquerading as Fortinet (Source: microsoft)](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQWytMk-IMx_dzgwaEBelORYU8LfFiWrwwAO87IECFFaWOPk_nVPHApYEKYwNCyEk8tZdStmb5LNV_DJc0xbFeVgBWLJHPRp5nd7z8e-uB90qTw0cWlvupaB9ddQ8w53mfR0zIoCUafLxLcfFRUHRjo05HevLABTEXHYdKuf5XksPBocmBoQSopv00-RLH/s624/Fig2-actor-controlled-website-1.webp)
Evasion Tactics and Indicators Of Compromise
To avoid detection, Storm-2561 uses a digital certificate issued by “Taiyuan Lihua Near Information Technology Co., Ltd.” to sign malicious installers and DLLs.
This signed code helps bypass default Windows security warnings and limits alerts from security tools. It gives the installation process a false sense of legitimacy.
| Indicator | Type | Description |
|---|---|---|
194.76.226[.]93 | IP Address | Active command-and-control server receiving stolen VPN data |
vpn-fortinet[.]com | Domain | Spoofed initial access domain used in SEO poisoning |
ivanti-vpn[.]org | Domain | Spoofed initial access domain used in SEO poisoning |
inspector.dll | File Name | Malicious DLL variant of Hyrax infostealer that extracts data |
Furthermore, the malware uses a highly deceptive post-theft technique. Microsoft after stealing the credentials, it displays a fake installation error.
It instructs the user to download the actual VPN client from official sources. Sometimes, it even opens the browser directly to the legitimate vendor’s website.
Because the subsequent legitimate VPN installation works perfectly, the victim assumes the first attempt was just a technical glitch and remains completely unaware of the compromise.
Organizations are advised to enable cloud-delivered endpoint protection, implement strict multifactor authentication (MFA) on all devices, and block executable files that do not meet the criteria of the trusted list. Below are critical indicators of compromise (IOCs) associated with this campaign.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
