Phishing Scheme Mimics WatchGuard Site to Harvest Enterprise VPN Credentials

Security researchers at Huntress have uncovered a credential-harvesting campaign that targeted corporate network administrators through lookalike download portals while delivering authentic, signed software packages to victims, according to a report from TechRadar Pro (https://www.techradar.com/pro/fake-vpn-download-site-steals-administrator-credentials-to-give-attackers-direct-access-to-corporate-networks-but-delivers-official-signed-software-so-victims-never-suspect-a-thing).

The attack vector avoids conventional endpoint security detection by leaving the client installer binary untouched. Instead, the deceptive site collected an organization's VPN server address, username, and password through an in-browser form before initiating a download of the genuine client directly from WatchGuard's content delivery network.

The investigation began after security operations detected suspicious activity involving an administrator at a managed service provider. The administrator searched Bing for a WatchGuard VPN download and navigated to a deceptive site hosted at watchguard-vpn[.]net, which mimicked the vendor's official interface.

When visitors attempted to download the software, the website requested connection parameters identical to those needed by the legitimate client. Submitting the form sent the data to a secondary domain, watchguard-ssl[.]online. The script rejected the first attempt and cleared the form fields, prompting a second entry and potentially providing the operators with multiple password attempts.

After the second submission, the portal initiated a download of WatchGuard's Mobile VPN with SSL client version 12.11.5. Huntress verified that the executable carried a valid digital signature from WatchGuard Technologies dated Nov. 4, 2025, and remained unmodified, leaving users unaware of the credential theft during a normal installation workflow.

According to Huntress, the download domain was registered on Aug. 22, 2026, and the credential-collection domain appeared on Sept. 14, 2026. WatchGuard had previously reported the lookalike domain in January, though researchers found no functional delivery mechanism at that time. The primary deceptive domain was offline by Oct. 13, 2026, though related infrastructure may still exist.

In the analyzed incident, detection occurred 21 seconds after the deceptive webpage loaded, allowing security teams to issue remediation guidance and reset credentials before network access could be escalated.