The SEO poisoning campaign targets clients on enterprise networks with credential phishing: harvesting server logins while offering genuine executables to evade security detection.
- Fake WatchGuard VPN Website Steals Administrator Credentials While Delivering Legitimate Software
- Attackers collected addresses, usernames and passwords from VPN servers
- The fraudulent website rejected initial submissions to collect credentials a second time.
A fraudulent WatchGuard download website stole VPN login details while providing the authentic installation package, experts claimed.
Huntress security researchers traced the activity to a similar domain that was collecting connection details before downloading the legitimate client.
The investigation began after suspicious activity was detected involving an administrator working for a managed services provider.
Latest videos ofTechnologyRadar
Fake download pages collect user credentials
Investigators discovered that the user had searched on Bing for a WatchGuard VPN download before visiting a deceptive website designed to look like the provider’s official download pages.
The website, watchguard-vpn[.]net, offered a purported mobile VPN with SSL offloading and displayed a form requesting the server address, username and password.
Those details matched the information required by the genuine VPN client, making the request appear consistent with a normal installation process.
Submitting the form transmitted the information to a separate domain, watchguard-ssl[.]online, where attackers harvested credentials for potential use against the organization’s network.
The malicious script rejected the first submission and deleted the fields, causing the victim to enter the information again and potentially providing the attackers with multiple password attempts.
Huntress revealed that the operators registered the download domain on August 22, 2026, while the credential harvesting domain appeared on September 14.
WatchGuard had previously reported on the similar direction in January, although researchers did not find any working mechanism directing visitors through the fraudulent download process.
Genuine software helps hide credential theft
After collecting the second submission, the website initiated a download from the official WatchGuard content delivery network instead of providing a fake installation package.
The file was Mobile VPN with SSL Client version 12.11.5, with a valid digital signature from WatchGuard Technologies and a timestamp dated November 4, 2025.
Huntress verified that the installer remained unchanged after signing, meaning the researchers found no evidence that the attackers had modified the legitimate executable.
This approach differs from campaigns that distribute crafted installers or malicious libraries, which endpoint protection products can identify through file inspection.
The authentic download also gives victims little reason to suspect that their credentials have already been compromised, as the installation can continue normally afterwards.
Huntress did not find any recorded downloads from the official server during the investigated incident, suggesting that the user may not have completed both credential submissions.
The detection occurred 21 seconds after the malicious website loaded, allowing the security operations team to provide remediation guidance before researchers observed further escalation.
Huntress reported that the main deceptive domain was offline as of October 13, although that status does not state whether the associated infrastructure remains active elsewhere.
The attack bypasses many malware checks because the fake website steals VPN credentials through the browser before downloading the original software.
Organizations should reset compromised passwords, enable multi-factor authentication, check for suspicious VPN logins, and direct employees to official software download pages.
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment