MalwareMar 13, 2026
Storm-2561 Spreads Trojan VPN Clients via SEO Poisoning to Steal Credentials
Microsoft disclosed a credential theft campaign called Storm-2561 that uses SEO poisoning to distribute fake VPN client trojans to unsuspecting users. The attackers redirect search engine traffic to malicious websites hosting digitally signed trojans designed to steal credentials by impersonating legitimate enterprise VPN software.
Summary
Microsoft disclosed a credential theft campaign called Storm-2561 that uses SEO poisoning to distribute fake VPN client trojans to unsuspecting users. The attackers redirect search engine traffic to malicious websites hosting digitally signed trojans designed to steal credentials by impersonating legitimate enterprise VPN software.
Indicators of Compromise
- malware — Storm-2561