Fake VPN download site steals administrator credentials to give attackers direct access to corporate networks — but delivers official signed software so victims never suspect a thing
A fake WatchGuard VPN download website stole administrator credentials before delivering the genuine signed installer, potentially exposing corporate networks without deploying malware.
A fraudulent WatchGuard VPN website harvested administrator login credentials while providing the authentic software, according to security experts. Researchers from Huntress traced the activity to a deceptive domain that mimicked the legitimate vendor's download pages. The website watchguard-vpn.net requested users to input their VPN server address, username, and password, which were then sent to a separate domain, watchguard-ssl.online, for attackers to collect.
The malicious site initially rejected the form submission, prompting the victim to re-enter the information. Once the credentials were obtained, the website proceeded to download the legitimate Mobile VPN with SSL client version 12.11.5, which carried a valid digital signature from WatchGuard Technologies. This method differs from typical malware campaigns that distribute tampered installers, as the authentic software was delivered after the credential theft.
Huntress found no evidence that the attackers had modified the legitimate installer, making it difficult for endpoint protection products to identify the threat. The fraudulent website was offline by October 13, but it's unclear if any infrastructure remains active. The attack highlights the importance of resetting compromised passwords, enabling multifactor authentication, monitoring VPN logins, and directing employees to official software download pages.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
