Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft

Microsoft Security Blog posts describe multiple active, high-impact campaigns and tradecraft trends: Storm-2561 uses SEO poisoning to push fake VPN clients that install signed trojans to steal VPN credentials and mimic trusted brands; signed malware using stolen EV certificates deployed legitimate RMM tools to achieve persistent access; Tycoon2FA (an AiTM PhaaS) operated at scale enabling widespread credential theft; malicious AI browser extensions harvested LLM chat histories and browsing data with ~900,000 installs affecting >20,000 enterprise tenants; the “Contagious Interview” campaign l l