[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBZMxDVcozadH1PIEqWRGYdv3bp-VMneSo1Hqrky4BL4":3},{"article":4,"iocs":37,"watch_terms":41},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":21},"27f53b28-54b8-4fe1-a589-2ae320ffe650","Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft","storm-2561-uses-seo-poisoning-to-distribute-fake-vpn-clients-for-credential-thef","Storm-2561 uses SEO poisoning to push fake VPN downloads that install signed trojans and steal VPN credentials. Active since 2025, Storm-2561 mimics trusted brands and abuses legitimate services. This post reviews TTPs, IOCs, and mitigation guidance. The post Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft appeared first on Microsoft Security Blog.","Storm-2561 is a threat actor group active since 2025 that uses SEO poisoning techniques to distribute fake VPN clients containing signed trojans designed to steal VPN credentials. The campaign impersonates trusted brands and abuses legitimate services to increase credibility and evade detection. Microsoft Security Blog provides TTPs, IOCs, and mitigation guidance for this ongoing threat.",null,"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F03\u002F12\u002Fstorm-2561-uses-seo-poisoning-to-distribute-fake-vpn-clients-for-credential-theft\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F03\u002FStorm-2561-featured.png","2026-03-12T17:00:00+00:00","2026-03-15T06:36:25.716027+00:00",9,[],"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":17,"icon":10,"name":19,"slug":20},"Malware","malware",[22,27,32],{"category":23},{"id":24,"icon":10,"name":25,"slug":26},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":28},{"id":29,"icon":10,"name":30,"slug":31},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":33},{"id":34,"icon":10,"name":35,"slug":36},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[38],{"type":20,"value":39,"context":40},"Storm-2561","Threat actor group distributing fake VPN clients with signed trojans for credential theft via SEO poisoning",[]]