What looks like a legit VPN download could be a trap, as SEO poisoning is being used to steal corporate logins.