[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVcQW7TYof7csCMBvwiwuJSATLRvfO4Nxu_rShrl5WPo":3},{"article":4,"iocs":36,"watch_terms":40},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":10,"entities":15,"category_id":16,"category":17,"article_tags":20},"38e1aa30-41ba-48cb-abab-c8e7c2dcb0cd","Storm-2561 Spreads Trojan VPN Clients via SEO Poisoning to Steal Credentials","storm-2561-spreads-trojan-vpn-clients-via-seo-poisoning-to-steal-credentials","Microsoft has disclosed details of a credential theft campaign that employs fake virtual private network (VPN) clients distributed through search engine optimization (SEO) poisoning techniques. \"The campaign redirects users searching for legitimate enterprise software to malicious ZIP files on attacker-controlled websites to deploy digitally signed trojans that masquerade as trusted VPN clients","Microsoft disclosed a credential theft campaign called Storm-2561 that uses SEO poisoning to distribute fake VPN client trojans to unsuspecting users. The attackers redirect search engine traffic to malicious websites hosting digitally signed trojans designed to steal credentials by impersonating legitimate enterprise VPN software.",null,"https:\u002F\u002Fthehackernews.com\u002F2026\u002F03\u002Fstorm-2561-spreads-trojan-vpn-clients.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhIHmOuzh2pt4Kd3D5FVJ3ryojQF5XMf6q51cdyxus7nMy4suicQ1RNW3_sjRA6OgE3H-JXTOoxz9wwMqEZQbJb9SXS7DOYTVUBK1MszgQoAR6rGGTgunHDAKM7NfOTkK-W2U9_5rT0Un6xn-cwMnGipbokPav0UoDL7eyQkKIrrKwa2h0BgCFqwuZe598R\u002Fs1600\u002Fvpn-download.jpg","2026-03-13T13:38:00+00:00","2026-03-14T09:41:13.354083+00:00",[],"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":16,"icon":10,"name":18,"slug":19},"Malware","malware",[21,26,31],{"category":22},{"id":23,"icon":10,"name":24,"slug":25},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":27},{"id":28,"icon":10,"name":29,"slug":30},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":32},{"id":33,"icon":10,"name":34,"slug":35},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[37],{"type":19,"value":38,"context":39},"Storm-2561","Credential theft campaign distributing trojanized VPN clients via SEO poisoning",[]]