Loading malware…
Hyrax is an information stealer used in a financially motivated credential-theft campaign attributed by Microsoft to Storm-2561. In the observed activity, victims searching for enterprise VPN software were redirected via SEO poisoning to spoofed vendor sites and malicious ZIP packages, including trojanized VPN installers impersonating Pulse Secure, Fortinet, Ivanti, GlobalProtect, and Sophos Connect. The infection chain used a fake MSI installer that dropped Pulse.exe together with malicious DLLs such as dwmapi.dll and inspector.dll into %CommonFiles%\Pulse Secure. The dwmapi.dll component acted as an in-memory loader that executed shellcode to load inspector.dll, which was identified as a variant of Hyrax. Hyrax captured VPN credentials entered into a fake VPN sign-in dialog, extracted URI and VPN sign-in credentials, and read stored configuration data from C:\ProgramData\Pulse Secure\ConnectionStore\connectionstore.dat. Stolen data was exfiltrated to attacker-controlled infrastructure, including 194.76.226[.]93:8080. The malware established persistence by adding Pulse.exe to the Windows RunOnce registry key. After stealing credentials, the fake client displayed an error and in some cases redirected victims to the legitimate vendor website to reduce suspicion. The campaign’s malicious binaries were digitally signed with a certificate issued to Taiyuan Lihua Near Information Technology Co., Ltd., which was later revoked. High-confidence related infrastructure mentioned in the reporting includes delivery via GitHub-hosted ZIP files and associated domains such as vpn-fortinet[.]com, ivanti-vpn[.]org, myconnection[.]pro, and v pn-connection[.]pro.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The dwmapi.dll file works as an in-memory loader, executing shellcode that loads inspector.dll — a variant of the Hyrax infostealer. Hyrax captures VPN credentials entered through the fake login screen and reads stored configuration data from C:\ProgramData\Pulse Secure\ConnectionStore\connectionstore.dat, sending everything to 194.76.226[.]93:8080.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
The trojans were digitally signed by a certificate issued to “Taiyuan Lihua Near Information Technology Co., Ltd.”... The digital signatures on these malicious files allowed them to bypass standard Windows security warnings and certain application allowlisting policies.
Users who click these results land on pages built to look identical to real VPN vendor portals, complete with matching logos and download buttons.
"The fake VPN client presents a graphical user interface... prompting the user to enter their credentials... the application captures the credentials entered and exfiltrates them..."
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hyrax is an infostealer used in fake VPN installer campaigns to capture VPN credentials and stored connection configuration data, then exfiltrate that information to attacker-controlled infrastructure. In this campaign it is delivered via a malicious MSI and loaded through DLL-based in-memory execution.
An information stealer variant used to harvest and exfiltrate VPN credentials, including through a fake VPN sign-in dialog.
Credential-stealing infostealer (delivered as inspector.dll) used in trojanized VPN installers to collect VPN URIs, sign-in credentials, and stored VPN configuration data (e.g., connectionstore.dat) and exfiltrate it to attacker-controlled C2.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.