"The threat actor added code in the installed binaries of the fake NetExtender so that information related to VPN configuration is stolen and sent to a remote server," Ganachari said.
Although caffeine and connectivity are easily available from public places, it's a real Sophie's Choice for IT and security leaders: Allow users direct access to the internet with no security controls, or route traffic to a remote data center using a VPN.