Storm-2561 - Fake VPN Process Hollowing (T1055.012)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Identifies the fake VPN installer executing process hollowing, spawning suspended legitimate .NET binaries (RegAsm.exe, InstallUtil.exe) to inject the Vidar or Lumma stealer payload.