During an investigation into exposed OpenWebUI servers, the Cybernews research team identified a malicious campaign targeting vulnerable OpenWebUI servers with cryptocurrency miners and Info Stealers.
Storm-2561 is relying on SEO poisoning to distribute fake VPN clients that install trojans and steal users’ credentials.