Hardware Ready Ready to Bench?
WatchGuard VPN. A targeted attack on corporate VPNs demonstrated that the mere presence of authentic software is not sufficient to guarantee security, especially when the download occurs from a fraudulent web page. Huntress researchers discovered a fake site impersonating WatchGuard, designed to steal network administrator credentials and subsequently provide them with the manufacturer’s legitimate software.
The investigation revealed how criminals collected access data before the actual download began. This sequence makes the scam particularly insidious, difficult to recognize even for security-conscious users. The software installation appeared regular and did not necessarily leave obvious traces of compromise.
WatchGuard VPN: why it matters
It all started when an administrator employed by a managed IT services provider, while searching on Bing to download the WatchGuard VPN client, came across a domain that combined the brand name with the word “vpn” and the .net extension. This address was specifically designed to resemble the official WatchGuard portal.
The web page offered the download of Mobile VPN with SSL and featured a form requesting crucial information for configuring the original program: the VPN server address, username, and password. These credentials, apparently necessary for installation, were sent to a separate second domain.
The second domain, with an .online extension, paired the term “WatchGuard” with “ssl” and was dedicated exclusively to collecting stolen credentials. According to Huntress, the site’s script rejected the first submission attempt and cleared the filled fields, prompting the victim to re-enter their credentials. This behavior allowed attackers to capture multiple login attempts.
Researchers reconstructed the infrastructure used for the attack. The domain dedicated to software download was registered on August 22, 2026, while the one used for credential theft appeared on September 14 of the same year. WatchGuard had already reported the suspicious address in January, but at that time, an operational mechanism comparable to the one later analyzed had not emerged.
Once credentials were obtained, the fraudulent site did not distribute a counterfeit program at all. Instead, the download occurred from WatchGuard’s official content delivery network. The downloaded package was Mobile VPN with SSL version 12.11.5, bearing a valid digital signature attributed to WatchGuard Technologies and timestamped November 4, 2025.
What changes and what are the effects
Huntress experts verified that the file had not been modified after signing and no evidence of executable alterations emerged. The credential theft occurred entirely through the web form, before the software installation could even begin.
This characteristic distinguishes the campaign from attacks that spread tampered applications or malicious libraries, which might be unmasked by file analysis. In this case, the security team identified suspicious activity 21 seconds after page load and provided guidance for managing the incident.
The fraudulent domain was offline on October 13, but it is not possible to confirm whether all related infrastructure has been deactivated. For businesses, this episode underscores the importance of carefully verifying download origins and protecting administrative accounts with multi-factor authentication.
In case of suspected credential exposure, it is fundamental to immediately reset passwords and check VPN access for anomalous activity. The validity of a digital signature alone does not certify the reliability of the website from which a file originates.
Source and further reading on WatchGuard VPN: original article.
* Content created with the assistance of artificial intelligence systems.