Stolen creds and stinging loaders: An initial access campaign via SEO poisoning

Summary

WithSecure is tracking an ongoing campaign that leverages SEO poisoning with the goal of gaining initial access into victim environments. This is achieved either by phishing for corporate VPN and remote desktop credentials or by delivering initial access malware such as the Bumblebee loader. The threat actor registers domains impersonating the targeted software and applies blackhat SEO techniques to boost their visibility across search results.

We assess that the threat actor likely operates as an Initial Access Broker (IAB) in the Ransomware-as-a-Service (RaaS) ecosystem, hence successful phishing or compromise can lead to extortion via data theft and/or data encryption.

WithSecure was able to trace back this campaign to earlier activity running since at least May 2025. The threat actor has previously leveraged Bumblebee loader as initial access malware and trojanized VPN software to harvest VPN credentials. Several prior reports have covered aspects of this campaign; however WithSecure discovered new and additional key findings, including:

1. Resurgence of Bumblebee loader as initial access malware by the threat actor.
2. Changes to the primary payload used by the threat actor to steal VPN credentials.
3. Additional web-based phishing methods to steal VPN and remote desktop credentials.
4. Insights into the blackhat SEO techniques leveraged by the threat actor.
5. Indicators suggesting development by a Russian-speaking threat actor.

Introduction

In Q2 2026, WithSecure investigated several customer incidents involving the execution of a malicious HTML application (.hta) that masqueraded as a WatchGuard SSL VPN client but functioned as a VPN credential stealer.

Upon further investigation, we discovered these HTA files were being distributed to victims via SEO poisoning. The threat actor had registered domains impersonating WatchGuard VPN software and applied black hat SEO techniques to surface them prominently across search results.

These incidents led WithSecure to investigate the wider activity cluster and unravel a larger campaign that traces back to at least May 2025. Several prior reports have covered aspects of this activity; however, we found that:

1. These incidents involved a new infection chain
2. The breadth of targeted applications reaches well beyond VPN clients into remote desktop and enterprise software
3. The threat actor also operates an additional attack chain which phishes credentials directly through web-based forms rather than file-based malware. A method that had not been detailed in available reporting.

Phishing for VPN credentials – Fake VPN clients

One of the primary objectives of the threat actor is to harvest VPN credentials that can serve as an initial access vector (IAV) into a victim’s network perimeter. To this end, the threat actor has impersonated a wide array of VPN software developed by most major and niche vendors, including:

1. WatchGuard Mobile VPN / Firebox SSL
2. Fortinet’s FortiClient
3. Sophos Connect
4. Check Point VPN
5. Palo Alto GlobalProtect
6. SonicWall NetExtender
7. BIG-IP Edge Client
8. NetScaler/Citrix Gateway

The attack chain begins when a user searching to download a VPN client clicks on one of the campaign’s sites in the search engine results page (SERP) that closely mimics the vendor’s legitimate download site. An example is shown in figure 1.

Figure 1. Example of user searching to download SonicWall’s NetExtender

Once the victim clicks to download the software on the lookalike site, they are served a malicious payload that is either hosted on legitimate third-party services, such as Dropbox or GitHub, or an attacker-controlled domain. In some instances, the threat actor uses a redirection chain to mask the main download link behind another attacker-controlled domain. The delivered payload is often bundled as an archive file (.ZIP). An example is shown in figure 2.

Figure 2. Example of fake Sophos Connect site with malicious Dropbox download link (ZIP file)

The delivered payload has varied over time. Between May 2025 and early 2026, WithSecure mainly observed trojanized MSI installers and custom PE-based payloads that led to VPN credential theft, some of which have been documented in the past.

Since February 2026, WithSecure observed the threat actor shift away from their traditional PE-based payloads and start delivering custom HTML application (.hta) files that masqueraded as the respective VPN client.

Once executed, the HTA file would load a highly convincing logon portal on the victim’s machine that masquerades as the respective VPN client. Any VPN credentials and configuration data that are entered into the logon portal are then exfiltrated to an attacker-controlled domain. An example is shown in figure 3.

Figure 3. Example of HTA payload with credential theft capabilities – fake Sophos Connect logon portal

To deceive the victim, a fake error message is displayed afterwards as decoy. An example is shown in figure 4.

Figure 4. Example of an error message shown as decoy

The payload dynamically fetches and renders the user interface (UI) of the fake VPN client by making an HTTP GET request to an attacker-controlled domain with a custom header “X-From-HTA” set as “yes-hta-2025”. An example code snippet is shown in figure 5.

Figure 5. Example code snippet to dynamically fetch and render fake VPN UI

The threat actor inserted dummy functions into the payload files to inflate their size, likely as a detection-evasion technique. An example is shown in figure 6.

Figure 6. Dummy code inserted into HTA files

Moreover, the threat actor leveraged an obscure technique to display the appropriate VPN application icon for each payload. Icon data was prepended to each HTA file and the HTA icon property was set to « # », causing mshta.exe to use the embedded icon when displaying the HTML application. Therefore, the resulting payloads are considered as polygot files, making them valid as both ICO and HTA file formats. An example is shown in figure 7.

Figure 7. Example of polyglot payload with icon data prepended to the HTA file

Web-based credential phishing

WithSecure identified a secondary method the threat actor employed to harvest VPN credentials using the same VPN software download lure described in the previous section. Rather than relying purely on file-based attack chains, the threat actor deployed phishing pages that harvested VPN credentials in some instances. For example, the victim would land on the download sites via SEO poisoning, but upon pressing the download link a phishing form would be overlayed, prompting the user to enter their VPN credentials. The entered VPN credentials would then be exfiltrated to an attacker-controlled domain and the legitimate software installer would be downloaded as a decoy. WithSecure identified the threat actor leveraging this technique to harvest VPN credentials for at least:

• NordLayer VPN
• Fortinet FortiClient
• BIG-IP Edge client
• SonicWall NetExtender
• Ivanti Secure Access
• WatchGuard VPN

Examples of the phishing pages are shown in figures 8 and 9.

Figure 8. Example of phishing form to harvest VPN credentials – SonicWall NetExtender

Figure 9. Example of phishing form to harvest VPN credentials – Ivanti Secure Access

Beyond VPN credentials, WithSecure also observed the threat actor leverage phishing pages to target credentials for remote desktop software such as Microsoft’s Remote Desktop Services web client (RDWeb) and Getscreen.me. In these instances, the lookalike sites acted as logon portals that would exfiltrate any entered logon credentials while showing an error message as decoy afterwards. An example is shown in figure 10.

Figure 10. Example of fake Getscreen.me logon portal exfiltrating entered credentials

The Bumblebee still stings

Several of the associated domains WithSecure found since March 2026 masqueraded as sites for software other than VPN and remote desktop applications. These included:

1. Azure CLI
2. PingPlotter
3. Nx Witness
4. Veeam Backup and Replication

These lookalike sites led to Bumblebee loader infections. The threat actor has leveraged Bumblebee loader throughout their earliest traced activity, dating between the second and third quarters of 2025. All the latest identified Bumblebee payloads contained the campaign ID: “1000”. Historical campaign IDs included: “grp0003” and “grp0004”.

For example, an associated lookalike site found in August 2026 for Veeam Backup & Replication software contained a Dropbox-hosted download link. The downloaded file was a modified ISO image for the respective software, with three modified or newly added files including:

1. Setup.exe, the original setup executable, modified to import veeamstat.dll
2. veeamstat.dll, a custom loader intended to run the main payload (x64.dll) via rundll32.exe « <SetupDir>\EnterpriseManager\x64.dll »,DllRegisterServer
3. x64.dll, VMProtect-packed Bumblebee loader

This discovery indicates the threat actor’s continued interest in targeting victims using a wide array of software within enterprise environments. Bumblebee loader infections through this campaign have been previously reported to lead to Akira ransomware intrusions. It is noteworthy that the Bumblebee loader was subject to an international takedown operation dubbed Operation Endgame in May 2024, however the loader resurfaced several months later, albeit at nowhere near the same level of activity.

Getting to the frontpage

The threat actor employs several blackhat SEO techniques, including cloaking and link building, to enhance the authenticity of the lookalike domains and boost their visibility across search results.

As part of their cloaking scheme, the domains serve a benign SEO-friendly website (referred to as “white page”) to any request that isn’t redirected from a search engine, such as search engine crawlers. Meanwhile, requests originating from a search engine are served the malicious content (referred to as “offer” or “black” page). Incidentally, this mechanism also serves as an anti-analysis technique.

WithSecure found an example of a custom cloaking script employed by the threat actor across some instances which filtered requests based on the visitor’s browser, operating system, and the request’s referrer header field, which is used to check whether the request originates from a supported search engine. An example code snippet is shown in figure 11. Notably, the list of supported search engines also contained entries for ChatGPT and Copilot to allow requests originating from these platforms. In addition to the custom cloaking script, WithSecure also found evidence of a third-party cloaking service used by the threat actor, namely cloaking[.]house.

Figure 11. Example code snippet of cloaking script

The content served across all the lookalike domains as white page were designed as “unofficial guides” related to the masqueraded software. These pages followed best SEO practices to improve their search result ranking. On the other hand, the offer (or black) pages were scraped copies of the official download pages for the respective software. An example of a white page is shown in figure 12.

Figure 12. White page masquerading as an unofficial guide for WatchGuard Mobile VPN client

WithSecure observed usage of ccTLDs (e.g. foobar.fi) across several of the identified lookalike domain names. The language used across these sites’ metadata (such as the site description displayed across search engine results) as well as their white pages were in the respective country’s main language. For example, French was used for domains ending with “.fr”. These geotargeting techniques were likely employed to expand the campaign’s reach by boosting the ranking of these domains across search results in certain geographies. Nearly all identified geography-specific domains were in Europe. Despite these geotargeting techniques, WithSecure did not observe any explicit geo-fencing to these sites, indicating the targeting is global in scope. An example is shown in figure 13, where a user in Finland searching for NetExtender is served the lookalike domain netextender[.]fi among the top results. Additional examples of geotargeted search results are shown in figure 14.

Figure 13. User from Finland searching to download NetExtender

Figure 14. Additional examples of geotargeted search results

Moreover, WithSecure observed the threat actor engage in blackhat link-building practices for some of the domains. For instance, we identified several backlinks to these lookalike domains injected across sites such as Private Blog Networks (PBNs). Examples are shown in figures 15 and 16.

Figure 15. Example of backlinks across Private Blog Networks (PBNs)

Figure 16. Example of backlinks injected across page sidebar and footer

The Russian links

Throughout the investigation, WithSecure repeatedly observed the use of Russian language in the form of code comments, debug messages, and filenames across artifacts found throughout the attack chain.

For instance, some of the cloned sites’ resources contained filenames appended with “Без названия” (Russian word for Untitled). An example is shown in figure 17.

Figure 17. Example of Russian language used in filenames

Some of the phishing pages contained debug messages in Russian. An example is shown in figure 18.

Figure 18. Example of Russian language used in debug messages across phishing pages

We also identified code comments in Russian across the HTA infection chains. An example is shown in figure 19.

Figure 19. Example of code comments across HTA infection chain

These indicators suggest development by a Russian-speaking threat actor, potentially hinting towards the threat actor’s origin or cybercrime ecosystem they operate within.

Conclusion

SEO poisoning remains a popular initial attack vector amongst threat actors. With the goal of establishing an initial foothold in a victim’s corporate environment, this campaign focuses on software such as VPN clients that are used in enterprise environments. By masquerading as trusted software and poisoning relevant search engine results, the threat actor hinges on the abuse of trust to lure users to malicious sites that can lead to credential phishing or malware delivery.

The consequences extend well beyond that initial compromise. We assess the threat actor likely operates as an Initial Access Broker within the Ransomware-as-a-Service ecosystem. A single employee downloading what appears to be a legitimate VPN client can therefore expose an organization to extortion via data theft, data encryption, or both.

The threat actor’s multi-pronged approach and broader software impersonation reflect an opportunistic threat actor that leverages any means necessary to gain initial access into organizations in an indiscriminate fashion. This is reflected by their shift from PE-based payloads to polyglot HTA credential stealers, a parallel web-based phishing chain, the expansion from VPN clients into remote desktop and wider enterprise software, and the resurgence of Bumblebee loader behind increasingly mature blackhat SEO tradecraft.

We suspect that the threat actor will continue leveraging this method for initial access, likely modifying parts of their tradecraft, such as delivered payloads and infrastructure, to further evade detection. However, by driving user awareness against these campaigns, their employed methods may become less effective over time, imposing a cost by forcing threat actors to adapt.

A full list of Indicators of Compromise (IOCs) and relevant YARA rules can be found in WithSecure’s GitHub [ https://github.com/WithSecureLabs/iocs/tree/master/Initial_Access_SEO_Poisoning/ ].

Recommendations

• Rotate potentially exposed VPN and remote desktop credentials immediately if compromise is assessed or suspected.
• Invest in Endpoint Protection, Detection and Response (EPP/EDR) solutions with network and file reputation coverage, as well as behavioral coverage for abuse of living-off-the-land binaries such as mshta.exe and rundll32.exe, and ensure alerts are triaged and actioned promptly.
• Restrict execution of HTML applications by blocking or limiting mshta.exe through application control solutions (e.g. AppLocker or WDAC) based on business needs and treat internet-downloaded container formats such as ISO images with heightened scrutiny.
• Enforce multi-factor authentication (MFA) for VPN, remote desktop, and other remote access services, preferring phishing-resistant methods such as FIDO2 or certificate-based authentication so that stolen credentials alone are insufficient to gain access.
• Ensure minimum privilege for VPN and remote desktop accounts and segment the network to limit the reach of a compromised account, reducing the value of harvested credentials to an Initial Access Broker and their customers.
• Drive user training and awareness to download software only from official vendor sites or an internal software portal rather than trusting top search results, noting that this campaign also accommodates traffic originating from AI assistants such as ChatGPT and Copilot.
• Distribute VPN clients and other enterprise software through managed channels, such as an internal software catalogue or endpoint management tooling, removing the need for users to search the web for installers.
• Leverage the published IOCs and YARA rules to hunt for related activity across endpoint and network telemetry.

WithSecure’s detection coverage

WithSecure™ Elements Endpoint Protection and WithSecure™ Elements Detection and Response offer detection and protection across various stages of the attack lifecycle.

WithSecure™ Elements Endpoint Protection detections include:

• Trojan:HTA/Hermes.A
• Trojan.TR/W64.MalwareX

WithSecure™ Elements Endpoint Detection and Response detections include:

• Suspicious Mshta Location
• Network Mshta

MITRE ATT&CK mapping