Credential-stealing crew spoofs VPN clients from Cisco, Fortinet, and others

A recent batch of security reporting highlights multiple active threats and law‑enforcement actions: Storm‑2561 is impersonating enterprise VPN clients (CheckPoint, Cisco, Fortinet, Ivanti, etc.) to steal credentials and then redirecting victims to legitimate vendor downloads to conceal the attack. Multiple actively exploited vulnerabilities were disclosed — including a Chrome emergency update for two zero‑days and a CISA‑warned max‑severity RCE in n8n — and a Microsoft Excel bug abusing Copilot Agent for zero‑click data disclosure. Other notable items include large takedowns/arrests (Interpol