Storm-2561 Uses Fake VPN Clients to Steal Credentials, Microsoft Says

Summary

Microsoft says Storm-2561 used SEO-poisoned search results and fake, digitally signed VPN installers to steal credentials through DLL sideloading; Microsoft removed malicious GitHub repositories and revoked a signing certificate.

Key points

• Microsoft observed the campaign in mid-January 2026 and attributed it to Storm-2561.
• SEO poisoning directed users searching for enterprise VPN software to malicious ZIP files hosted on attacker-controlled sites and GitHub.
• Trojanized MSI installers sideload malicious DLLs and can deploy the Bumblebee loader or Hyrax information stealer.
• A fake VPN sign-in dialog captures credentials, then displays an error and may direct users to the legitimate vendor site.
• The malware uses the Windows RunOnce registry key for persistence and exfiltrates collected VPN credentials.
• Microsoft removed malicious GitHub repositories and revoked the certificate used to digitally sign the malicious components; users are advised to enable MFA and verify software downloads.

Indicators of compromise

MITRE ATT&CK

Threat Actors

Malware

Vendors

Products

Related Articles

• Symantec Report Tracks Rising Encryptionless Extortion and New Ransomware Actorsgithub.com/jacobdjwilsonBumbleBee · Microsoft
• Fake WatchGuard VPN Site Harvests Credentials, Then Delivers Genuine Signed Clienthuntress.comStorm-2561 · Microsoft
• Microsoft Details Agentic AI Attacks Using Exposed Secrets to Access Cloud Resourcesmicrosoft.comGitHub · Microsoft
• Microsoft Details North Korean Threat Actors’ Expanding Use of AImicrosoft.comGitHub · Microsoft
• Blue October Roundup, Upwind’s $400M Raise and AI Audit-Trail Book Launchcybersecuritypulse.netGitHub · Microsoft