Fake VPN Installers Steal Credentials as Router Proxy Botnet Is Disrupted

Summary

Security Now discusses a credential-stealing campaign using fake VPN installers, the takedown of a residential proxy service, router defenses and changes to encrypted messaging.

Key points

• Microsoft attributes a fake VPN installer campaign to Storm 2561. The signed installers sideload a Hyrax information stealer that collects VPN credentials.
• The malicious repositories were taken down and the signing certificate was revoked, according to Microsoft.
• Law enforcement seized infrastructure associated with Socks Escort, which authorities described as a proxy service built on infected modems and routers.
• Steve Gibson advised against exposing router management interfaces to the internet and said rebooting may clear malware that resides only in memory.
• Meta plans to discontinue Instagram's optional encrypted chats after May 8, 2026, citing low adoption.
• The European Parliament backed an extension of voluntary chat-scanning rules with restrictions; the transcript says agreement with the Commission and member states is still needed.
• A ransomware negotiator is accused of participating in attacks against clients and sharing confidential negotiation information with accomplices.

Indicators of compromise

Threat Actors

Malware