Hackers Use Fake WatchGuard VPN Download Site to Steal Login Credentials

Hackers used a fake WatchGuard VPN download website to steal login details before offering visitors the real, digitally signed VPN installer.

The attack collected a VPN server address, username, and password through a browser pop-up, leaving victims exposed without installing a malicious client.

The campaign shows how a normal software search can lead to credential theft. Similar search engine poisoning attacks have pushed fake websites into trusted search results, making a high ranking a poor guide to whether a download page is safe.

Researchers from Huntress identified the campaign while investigating an October 7 incident involving an administrator at a managed service provider.

Their October 13 report described phishing, not a malware-laced installer: the theft happened inside the browser before the genuine software download.

Hackers Use Fake WatchGuard VPN Download Site

The administrator searched Bing for “watchguard vpn sll download,” then opened the fake website eight seconds later. Investigators traced the visit through Bing’s normal search-result redirect.

That evidence supported search engine optimization poisoning, rather than a paid malicious advertisement, as the route into the trap.

The landing page used WatchGuard branding, product information, and a questions section to appear useful. A download button led to a fake support page offering clients for different operating systems.

A footer called it an independent fan site, despite the download flow presenting itself as a support service. Selecting any download option opened a prompt requesting Server, Login, and Password.

Those fields match the details needed for a normal VPN connection, making the request appear familiar. Earlier fake Ivanti download sites used similar vendor impersonation, although that campaign delivered altered installers rather than collecting everything through a browser form.

The capture logic used roughly 150 lines of readable JavaScript. It placed the submitted values into JSON and sent them through an HTTP POST request to a separate collection server. Each submission included a label showing whether it was the first or second attempt.

The script always rejected the first entry, cleared the fields, and displayed an “Incorrect data” message. This could prompt victims to correct a mistyped password or try another one, giving attackers another set of details.

How the Credential Theft Worked

Failed network requests only generated a browser-console warning, avoiding a visible error. After the second submission, the message turned green and a hidden link started downloading WatchGuard Mobile VPN with SSL version 12.11.5 from the vendor’s official content delivery network.

Huntress verified that its digital signature remained valid and that the signed content had not changed. This differs from earlier VPN credential theft linked by Microsoft to Storm-2561, which used fake installers and malicious DLLs before directing victims toward genuine software.

Huntress did not establish that the same operators controlled both registrations of the reused phishing domain. In the investigated incident, browser history showed no download from WatchGuard’s delivery network.

Huntress said this suggested the administrator had not completed both prompts, although a first submission remained possible. Managed Defender flagged the activity 21 seconds after the page loaded, allowing responders to provide remediation guidance before escalation.

The lure domain was offline by October 13. Organizations should reset exposed passwords, treat submitted VPN server addresses as known to attackers, enforce multifactor authentication, and review unusual VPN logins.

Staff should use bookmarked links to the official WatchGuard software portal rather than search results. A valid installer signature does not prove that the website supplying it handled credentials safely.

Indiccators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.