Threat Actor Targeting VPN Users in New Credential Theft Campaign

0:00Visit our website austintinvestigate.com. A threat actor tracked a storm 2561 has been targeting VPN users in a new credential theft campaign, Microsoft Reports. Active since at least May 2025, storm 2561 is known for using search engine optimization, SEO, poisoning from malware distribution and for impersonating popular software vendors to attract victims to malicious websites. The newly observed campaign started in mid-January, aimed at learning individuals looking for VPN software into downloading trojans that have been signed with a legitimate digital certificate to evade detection. Not only did the threat actor abuse users trust in search engine rankings, but they also hosted the malicious payloads on GitHub repositories, further increasing the chances of successful infections. In the repositories associated with the campaign, which have been removed, storm 2561 hosted a zip file containing

1:00an MSI installer file posing as the legitimate VPN software pulse secure. Using SEO poisoning, the threat actor ensured that victims searching for pulse VPN download or pulse secure client would receive malicious results at the top of the search page. Other brands were also impersonated as part of the campaign, Microsoft says. Users clicking on a poison result were taken to a malicious download website, but the payload was served as the zip archive fetched from GitHub. During installation, the MSI inside the zip file side loaded a DLL to drop and launch a variant of the high racks information stealer that would collect URI and VPN credentials and exfiltrate them to an attacker controlled command and control, CNC, server. Both the MSI and the DLL were signed with a valid certificate from Taiyuan LiHuan near information technology company, limited, which has since been revoked. Other files signed with the same certificate were also identified, all posing as VPN applications. The fake VPN client installed in this attack mimicked

2:05the legitimate application, displaying a GUI that prompted the victim to introduce their credentials. The login information was immediately sent to the attacker's CNC server. The MSI installed was also observed establishing persistence through the windows run once registry key by adding the fake VPN application to start up. After collecting the victim's credentials, the fake software displayed an installation error message, providing instructions on how to download the legitimate pulse VPN client, and in certain instances, opening the browser to the legitimate VPN website. If users successfully install and use legitimate VPN software afterward, and the VPN connection works as expected, there are no indications of compromise to the end user. Users are likely to attribute the initial installation failure to technical issues, not malware, Microsoft notes.