Threat Actor Targeting VPN Users in New Credential Theft Campaign