Storm-2561 runs an SEO‑poisoning campaign that lures users to spoofed vendor sites and attacker‑hosted repos serving digitally signed, trojanized VPN installers that sideload malicious DLLs (Hyrax), harvest and exfiltrate VPN credentials and config data, maintain persistence (e.g., RunOnce), and hide the compromise with decoy errors while researchers publish IOCs and mitigations.
