Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft | Microsoft Security Blog

https://www.microsoft.com/en-us/security/blog/2026/03/12/storm-2561-uses-seo-poisoning-to-distribute-fake-vpn-clients-for-credential-theft/