SEO Poisoning and Fake Software Downloads Used to Deliver Credential Theft and RAT Malware

Threat actors are using software impersonation and SEO poisoning to push victims toward fake download sites for trusted enterprise and IT tools, then delivering malware through trojanized installers. In one campaign, Storm-2561 used spoofed VPN vendor pages for products such as Pulse Secure, Fortinet, and Ivanti to steal enterprise VPN credentials. The malicious packages were hosted on GitHub, signed with a certificate issued to "Taiyuan Lihua Near Information Technology Co., Ltd.", and designed to show an error before redirecting victims to the legitimate vendor site, reducing suspicion while exfiltrating credentials.

A separate but closely related campaign used fake FileZilla download pages to distribute a Remote Access Trojan through multi-stage loaders and DLL sideloading. Attackers bundled legitimate FileZilla software with a malicious version.dll, or dropped the DLL during installation so the malware would execute while the expected application appeared to install normally. Both reports describe the same broader intrusion pattern: adversaries abusing trusted brands, realistic lookalike websites, and legitimate software packaging to compromise users who believe they are downloading authentic tools. A separate Warlock intrusion analysis describing web shells, lateral movement, tunneling, and ransomware activity is a different incident and does not match this malware-delivery story.