The Register on MSN
Credential-stealing crew spoofs VPN clients from Cisco, Fortinet, and others
And then they send victims to the legit VPN download to hide their tracks A group of cybercriminals tracked as Storm-2561 is ...
ThreatsDay roundup covering stealthy attacks, phishing trends, exploit chains, and rising security risks across the threat landscape.
The financially motivated group has been active since May 2025, impersonating Fortinet, Ivanti, Cisco, and other vendors to steal corporate credentials.
Storm-2561 spreads fake VPN installers via SEO poisoning and GitHub downloads, stealing enterprise VPN credentials with Hyrax malware.
Latest FortiOS capabilities help organizations secure AI adoption, simplify operations, and strengthen protection across ...
Storm-2561 is relying on SEO poisoning to distribute fake VPN clients that install trojans and steal users’ credentials.
Some results have been hidden because they may be inaccessible to you
Show inaccessible results