VulnHub

Real-time Cybersecurity News

Threat Actor Targeting VPN Users in New Credential Theft Campaign

SecurityWeek
Actively Exploited
Malware

Overview

A group known as Storm-2561 is targeting VPN users by distributing fake VPN clients through search engine optimization (SEO) poisoning. This tactic leads users to download malicious software that can steal their login credentials. The campaign employs trojans to compromise users' systems and gain access to sensitive information. This threat is particularly concerning as it exploits the growing reliance on VPN services for online security, making it crucial for users to verify the authenticity of software before installation. Researchers warn that users should be cautious and ensure they are downloading VPN clients from trusted sources to avoid falling victim to this scheme.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: VPN clients, user login credentials
  • Action Required: Users should only download VPN software from official websites and verified sources.
  • Timeline: Newly disclosed

Original Article Summary

Storm-2561 is distributing fake VPN clients through SEO poisoning, deploying trojans, and stealing login information. The post Threat Actor Targeting VPN Users in New Credential Theft Campaign appeared first on SecurityWeek.

Impact

VPN clients, user login credentials

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should only download VPN software from official websites and verified sources. Regularly updating software and using strong, unique passwords can also help mitigate risks.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware.

Read Original Article

Related Coverage

ClickFix campaigns target macOS users via MacSync infostealer

SCM feed for Latest

Recent ClickFix campaigns are targeting macOS users through malicious tools disguised as ChatGPT applications. Attackers are utilizing deceptive tactics, including fake software and Terminal commands, to install the MacSync infostealer on infected systems. This infostealer is designed to harvest sensitive information from users, which poses a significant risk to personal and organizational security. Users who inadvertently download these fake tools could find their data compromised, leading to potential identity theft or financial loss. It's crucial for macOS users to remain vigilant and avoid downloading software from untrusted sources.

Mar 16, 2026

CISA flags Wing FTP Server flaw as actively exploited in attacks

BleepingComputer

The Cybersecurity and Infrastructure Security Agency (CISA) has alerted U.S. government agencies about a vulnerability in Wing FTP Server that is currently being exploited in attacks. This flaw could potentially allow attackers to execute remote code, raising the risk of severe security breaches. Organizations using this software need to take immediate action to secure their systems, as the vulnerability could be linked to more extensive exploitation tactics. The warning is particularly urgent for agencies that manage sensitive data, as the consequences of an attack could be significant. It's crucial for affected users to stay vigilant and apply any available security measures to mitigate risks.

Mar 16, 2026

UK’s Companies House confirms security flaw exposed business data

BleepingComputer

Companies House, the British agency responsible for company registration in the UK, recently confirmed that a security flaw in its WebFiling service exposed sensitive business information since October 2025. The agency temporarily took the service offline on Friday to address the issue, which raised concerns about the privacy of companies' data. While they have since restored the service, the breach could have serious implications for businesses relying on the registry for compliance and reporting. Companies should review their security practices and remain vigilant about potential misuse of their exposed information. This incident underscores the need for robust security measures in public-facing services.

Mar 16, 2026

FBI investigates malware in Steam games, seeks victim information

SCM feed for Latest

The FBI is investigating reports of malware affecting several games on the Steam platform. The games under scrutiny include BlockBlasters, Chemia, Dashverse/DashFPS, Lampy, Lunara, PirateFi, and Tokenova. This investigation comes as a response to concerns that these games may have been compromised, potentially putting users at risk. The FBI is looking to gather information from victims who may have been affected by this malware. This situation raises alarms about the security of online gaming platforms and the potential for malware to spread through popular titles, which could impact a large number of gamers. Users should remain vigilant and consider the security of the games they play.

Mar 16, 2026

Companies House Restores WebFiling After Flaw Exposed Director Details

Hackread – Cybersecurity News, Data Breaches, AI and More

Companies House, the UK's official register of companies, recently addressed a significant flaw in its WebFiling service. This vulnerability allowed unauthorized users to not only view sensitive director details but also modify company records. The issue prompted Companies House to take the service offline temporarily while they worked on a fix. After resolving the flaw, the WebFiling service was restored, but the incident raises concerns about the security of sensitive corporate information. Users and companies relying on this service need to be aware of the potential risks associated with such vulnerabilities.

Mar 16, 2026

Security Firm Executive Targeted in Sophisticated Phishing Attack

SecurityWeek

A security firm executive was targeted in a sophisticated phishing attack that utilized advanced techniques to deceive the victim. The attackers sent a DKIM-signed email that appeared legitimate, employing trusted redirect infrastructure and compromised servers to facilitate the attack. They also created phishing pages protected by Cloudflare, making them harder to detect. This incident raises concerns about the security measures in place for executives and highlights the need for increased vigilance against such tactics. Companies must ensure their employees are trained to recognize phishing attempts, especially those involving seemingly legitimate communications.

Mar 16, 2026