Search, Click, Steal: The Hidden Threat of Spoofed Ivanti VPN Client Sites

A recent malware campaign uses SEO poisoning on Bing to distribute a trojanized Ivanti Pulse Secure VPN client via lookalike domains. Users are tricked into downloading a malicious MSI installer that steals VPN credentials from the connectionstore.dat file. Stolen credentials are exfiltrated to a command and control server hosted on Azure infrastructure. The attack employs signed executables and referrer-based conditional content delivery to evade detection. This credential theft technique has been linked to subsequent Akira ransomware deployments. Organizations are advised to implement multi-factor authentication, conduct user awareness training, and monitor for suspicious network and endpoint activity. No CVE or known exploits in the wild are reported yet. The threat poses a medium severity risk due to credential compromise and potential ransomware follow-on attacks. European organizations using Ivanti Pulse Secure VPN are at risk, especially in countries with high adoption of this VPN solution and critical infrastructure sectors.

• SEO Poisoning Campaign Delivers New Armorsteal MalwareMalware2026-10-22
• LiteLLM supply chain compromiseCampaign2026-10-22
• Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 AccountsMalware2026-10-20
• From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM UsageCampaign2026-10-21
• Variola: From ClickFix to a Modular ImplantMalware2026-10-16