Fake WatchGuard VPN Download Site Stole Admin Credentials, Served Signed Client

Huntress began investigating after suspicious activity involving an administrator at a managed service provider. The administrator had searched Bing for a WatchGuard VPN download and visited watchguard-vpn[.]net, which resembled the vendor's official download pages and offered a purported Mobile VPN with SSL download. The page displayed a form requesting the server address, username and password — details the genuine VPN client also requires — making the request appear consistent with an ordinary installation.

Submitting the form sent the information to a separate domain, watchguard-ssl[.]online, where attackers collected the credentials for potential use against the organization's network. A malicious script rejected the first submission and cleared the fields, prompting the victim to enter the details again and potentially supplying attackers with multiple password attempts.

Huntress found that the operators registered the download domain on Aug. 22, 2026, while the credential-collection domain appeared on Sept. 14. WatchGuard had reported the lookalike address in January, although researchers then found no functioning mechanism directing visitors through the fraudulent download process.

After the second submission, the website downloaded the client from WatchGuard's official content delivery network rather than providing a counterfeit package. The file was Mobile VPN with SSL client version 12.11.5, carrying a valid digital signature from WatchGuard Technologies and a timestamp dated Nov. 4, 2025. Huntress verified that the installer remained unchanged after signing and found no evidence that attackers had modified the legitimate executable. This differs from campaigns that distribute tampered installers or malicious libraries, which endpoint protection products may identify through file inspection.

The authentic download also gave victims little reason to suspect their credentials had already been compromised, because installation could proceed normally afterward. Huntress found no recorded download from the official server during the investigated incident, suggesting the user might not have completed both credential submissions. The detection arrived 21 seconds after the malicious website loaded, allowing the security operations team to provide remediation guidance before investigators observed further escalation.

Huntress reported that the main deceptive domain was offline by Oct. 13, although that status does not establish whether associated infrastructure remains active elsewhere. The fake website steals VPN credentials through the browser before downloading genuine software, avoiding many malware checks. Organizations should reset compromised passwords, enable multifactor authentication, check for suspicious VPN logins and direct employees to official software download pages.