SonicWall warns of trojanized NetExtender stealing VPN logins

SonicWall and Microsoft warn that threat actors are distributing trojanized NetExtender v10.3.2.27 installers via spoofed websites and malvertising; modified binaries bypass certificate checks and exfiltrate VPN credentials and configuration data (username, password, domain, etc.) to 132.196.198.163:8080. Users are advised to download only from official SonicWall portals and scan installers with up-to-date AV tools.