Beware of fake SonicWall VPN app that steals users' credentials

Unknown actors distributed a Trojanized SonicWall NetExtender 10.3.2.27 installer signed with a fake "CITYLIGHT MEDIA PRIVATE LIMITED" certificate via spoofed download sites; the attackers modified NeService.exe to bypass certificate validation and altered NetExtender.exe to steal VPN configuration data (usernames, passwords, domains, etc.) and exfiltrate it to 132.196.198.163:8080. SonicWall and Microsoft removed the malicious sites and revoked the fraudulent certificate, but attackers could recreate spoofed domains, so users should only download VPN clients from vendor-trusted sources.