Malicious Ivanti VPN Client Sites in Google Search Deliver Malware — Users Warned

Cybersecurity researchers have uncovered a sophisticated malware campaign that uses search engine optimisation poisoning to push a trojanised Ivanti Pulse Secure VPN client. According to Zscaler, threat actors have poisoned search results to direct users to lookalike domains such as ivanti-pulsesecure[.]com and ivanti-secure-access[.]org, registered in September 2025, which imitate legitimate Ivanti sites and host convincing download pages.

When users click the download button, a trojanised MSI installer is downloaded, and the file is digitally signed, a technique intended to evade detection. At the time of analysis, only 2 of 58 antivirus vendors on VirusTotal flagged the malicious installer, illustrating the campaign’s effectiveness against traditional security tools.

The malware communicates with a command-and-control server at 4.239.95[.]1 on port 8080 hosted on Microsoft Azure, employs referrer-based content delivery to evade scrutiny, and exfiltrates stolen VPN credentials via HTTP POST requests. The broader context links this campaign to ransomware operations such as Akira, highlighting the need for multifactor authentication, user education about unverified downloads, and monitoring for suspicious outbound connections.