indicatorurl
hxxps://github[.]com/latestver/vpn/releases/download/vpn-client2/VPN-CLIENT.zip
- First seen
- 2026-05-14
- Last seen
- 2026-05-14
- Sightings
- 1
Posts referencing this indicator
- Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft
Malicious ZIP payload URL hosted on GitHub containing the fake VPN installer.