Fake WatchGuard VPN Site Stole Admin Logins, Then Served the Real App

How the fake WatchGuard VPN site worked

The page looked like a vendor download portal, and the form asked for exactly what the real client asks for.

Huntress started digging after an administrator at a managed service provider showed suspicious activity. The admin had searched Bing for a WatchGuard VPN download and landed on watchguard-vpn[.]net, a domain built to resemble WatchGuard's official download pages.

The site offered a "Mobile VPN with SSL" download and put a form in front of it: server address, username, password. Anyone who has installed the real client knows those are the fields it wants, so nothing about the request feels out of place.

Submitting the form pushed the details to a separate domain, watchguard-ssl[.]online. The script then rejected the first attempt and cleared the fields, so the victim typed everything again. That second pass handed the operators a fresh set of credentials and, in effect, a second password attempt.

Registration dates tell their own story. Huntress found the download domain registered on August 22, 2026, with the credential-collection domain appearing on September 14. WatchGuard had already reported the lookalike address back in January, but at that point researchers found no working mechanism pushing visitors through a fake download.

The genuine installer is the cover story

After the second submission, the site pulled the real client from WatchGuard's content delivery network.

The file that arrived was Mobile VPN with SSL client version 12.11.5, carrying a valid WatchGuard Technologies signature and a timestamp of November 4, 2025. Huntress checked and found the installer unchanged after signing, so there is no evidence the attackers tampered with the executable.

That is the clever part. Most download-based attacks hand over a poisoned installer or a malicious library, and endpoint protection has a decent chance of catching the file on inspection. Here the file is clean because it is the vendor's own build, fetched from the vendor's own servers.

The victim also gets a working VPN client. Installation completes, the connection works, and there is little reason to wonder whether the credentials were already gone. The theft happens in the browser before the download even starts, which is why malware-focused defenses have so little to work with.

One detail from the Huntress write-up is worth holding onto: investigators found no recorded download from the official server during the incident. The user may never have finished both credential submissions. The detection fired 21 seconds after the malicious page loaded, giving the security operations team room to step in with remediation guidance before anything escalated.

Why search results are the front door

The victim did not mistype a URL. They searched, and the fake page was waiting.

This is SEO poisoning in its plainest form: rank a lookalike page for a query that IT staff type all day, then let the search engine do the delivery. Bing was the route in this case, but the technique is not tied to one engine. It is the same playbook behind the fake calendar invites that hit 40,000 firms in a Microsoft phishing surge: trusted surface, familiar form, credentials gone.

The targeting matters too. A consumer hunting for a free VPN is a nuisance. An administrator at a managed service provider is a key to many front doors at once, and VPN credentials are exactly the kind of access attackers want before they go looking for anything else.

Huntress reported the main deceptive domain was offline by October 13. That says nothing definitive about the rest of the infrastructure, and lookalike domains are cheap enough that a takedown is rarely the end of a campaign.

• Reset any credentials entered on a download page you did not reach from the vendor's own site.
• Turn on multifactor authentication for VPN access, ideally with hardware keys or number matching.
• Review VPN logs for logins from unfamiliar addresses or at odd hours.
• Send staff to official vendor download pages through bookmarks or the vendor's documentation, not search results.

What it means for you

The campaign is not tied to a country. Any organization running WatchGuard's Mobile VPN with SSL client, in the US, UK, EU or elsewhere, is a plausible target if an employee searches for the download instead of going to WatchGuard directly. The domain was offline by October 13, but related infrastructure may still exist.

WatchGuard has not published a customer advisory tied to this specific incident that we can point to, so treat the Huntress findings as the primary account. If your team installed the client recently, check where the installer came from.

The uncomfortable lesson is that a clean download is no longer proof of a clean page. Attackers did not need to break WatchGuard's signature; they only needed an administrator in a hurry and a search result that looked right. Bookmark the vendor page, and check the URL before typing a password.