Credential-stealing crew spoofs Ivanti, Fortinet, Cisco VPNs • The Register

A sophisticated credential-stealing campaign has been uncovered by Microsoft, targeting enterprise VPN users through a clever deception that combines SEO manipulation, fake software downloads, and legitimate vendor redirects. The operation, attributed to a cybercrime group tracked as Storm-2561, demonstrates how attackers are evolving their tactics to bypass traditional security awareness training.

The VPN Spoofing Operation

The campaign exploits a common workplace scenario: employees searching for VPN client updates or downloads. When users search for terms like "Pulse VPN download" or "Fortinet VPN client," malicious websites have been pushed to the top of search results through search engine optimization manipulation. These sites meticulously mimic legitimate vendor pages, complete with authentic-looking branding and download buttons.

Once users click through, they're directed to GitHub repositories hosting malicious Windows Installer (MSI) files. These installers appear legitimate but contain hidden malware components. The files are signed with a valid digital certificate from Taiyuan Lihua Near Information Technology Co., Ltd., which has since been revoked, highlighting how attackers exploit the trust placed in code signing.

The Credential Harvesting Mechanism

The malicious installers use a technique called DLL sideloading, where legitimate executable files are tricked into loading malicious dynamic link library files. In this case, the installer loads two malicious DLLs: dwmapi.dll and inspector.dll. These files work in tandem to create a convincing fake VPN client interface.

When users launch what they believe is their VPN client, they're prompted to enter their credentials. The fake application captures usernames and passwords, then transmits this sensitive information to attacker-controlled command-and-control servers. Throughout this process, the application maintains the appearance of a legitimate VPN client, complete with familiar interfaces and error messages.

The sophistication of this attack lies in its final step. After credential capture, the malicious application displays an error message claiming the installation failed. It then instructs users to download the legitimate VPN client from the vendor's official website. In some instances, the malware even automatically opens the user's browser to the correct vendor page.

Why This Attack Works

This approach is particularly effective because it eliminates the red flags that typically alert users to malware. Traditional malicious downloads often result in applications that don't work properly, display unusual error messages, or behave erratically. Here, the opposite occurs: users successfully install and use legitimate VPN software, leading them to believe the initial failure was simply a technical glitch.

Microsoft notes that "if users successfully install and use legitimate VPN software afterward, and the VPN connection works as expected, there are no indications of compromise to the end user." This creates a perfect cover story where victims attribute the entire experience to technical issues rather than recognizing they've been compromised.

The Scope of the Campaign

The attackers have created fake websites for multiple VPN vendors, including CheckPoint, Cisco, Fortinet, Ivanti, Pulse Secure, SonicWall, Sophos, and WatchGuard. The GitHub repositories hosting the malicious installers have been taken down, but the campaign's infrastructure included domains such as vpn-fortinet[.]com and ivanti-vpn[.]org.

Storm-2561, the group behind this operation, has been active since May 2025 and represents a newer category of cybercrime organizations that Microsoft tracks with numerical designations. These groups typically employ SEO manipulation and vendor impersonation as core tactics, suggesting this VPN campaign is part of a broader pattern of sophisticated social engineering attacks.

Security Recommendations

While Microsoft's report naturally emphasizes its own security solutions, several vendor-neutral recommendations emerge from this analysis. The most critical is implementing multi-factor authentication (MFA) across all accounts. MFA would render stolen credentials useless without the second authentication factor, significantly reducing the impact of such attacks.

Organizations should ensure MFA is enforced universally, removing any exceptions and requiring it from all devices and locations. Additionally, employees should be trained not to store workplace credentials in browsers or password managers that are secured with personal credentials, as this creates additional attack vectors.

The Broader Implications

This campaign represents a concerning evolution in cybercrime tactics. By combining SEO manipulation, legitimate code signing, realistic fake applications, and strategic redirection to genuine software, attackers have created a nearly undetectable attack chain. The success of this approach suggests we may see similar tactics applied to other types of enterprise software beyond VPNs.

For IT security teams, this underscores the importance of defense-in-depth strategies that don't rely solely on user awareness. Technical controls like MFA, network monitoring for unusual credential usage patterns, and endpoint detection for suspicious installation behaviors become crucial when attackers can create such convincing deceptions.

The Storm-2561 campaign demonstrates that in the ongoing arms race between cybercriminals and defenders, attackers continue to find innovative ways to exploit human psychology and technical trust mechanisms. Organizations must adapt their security postures accordingly, recognizing that even sophisticated users can be fooled by attacks that appear legitimate from start to finish.