Fake VPN to Steal Credentials (dwmapi.dll and inspector.dll)

Lightkun Yagami@lightkun_CrowdStriker

•updated Apr 19, 2026•16•0•209

This is to search for the malicious dll loader, dwmapi.dll and the infostealer dll, inspector.dll. This search is from Microsoft's published article, "Storm-2561 users SEO poisoning to distribute fake VPN clients for credential theft". This will look for the two dll files digitally signed from Taiyuan Lihua Near Information Technology Co., Ltd.