Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft

Reported 16 Mar 2026 by otx · Severity: medium

A credential theft campaign by Storm-2561 exploits SEO poisoning to distribute fake VPN clients. Users searching for legitimate VPN software are redirected to malicious websites hosting ZIP files containing trojans masquerading as trusted VPN clients. These digitally signed troja