Storm-2561 is relying on SEO poisoning to distribute fake VPN clients that install trojans and steal users’ credentials.