Storm-2561 Uses SEO Poisoning to Distribute Fake VPN Software and Steal Corporate Credentials
150/69 Monday, March 16, 2026 Researchers from Microsoft Defender have identified a credential-theft campaign linked to the threat actor Storm‑2561. In this campaign, attackers use SEO poisoning to manipulate search engine rankings. When users search for terms such as “Pulse Secure client” or “VPN download,” they are redirected to fake websites impersonating legitimate vendors including […]
