Fake WatchGuard site steals admin credentials while serving legitimate signed software
Huntress found a phishing site that harvested VPN login details for administrators before delivering the genuine, signed client installer to avoid suspicion.
Key points
- The fraud used a lookalike domain to collect server addresses, usernames, and passwords from victims.
- Attackers delivered the authentic WatchGuard Mobile VPN client to conceal the credential theft.
- The malicious script rejected initial submissions to capture multiple password attempts.
Security researchers at Huntress identified a fraudulent website that stole administrator credentials for WatchGuard VPN servers while simultaneously delivering the legitimate, digitally signed installation package to victims. This technique allowed attackers to harvest sensitive login details without deploying malware or providing counterfeit software.
The investigation originated after Huntress detected suspicious activity involving an administrator at a managed service provider. According to TechRadar, the user had searched for a WatchGuard VPN download on Bing and subsequently visited a deceptive site mimicking the vendor’s official pages. The site requested standard connection parameters, making the data collection appear routine.
The Attack Mechanism
The fraudulent domain, watchguard-vpn[.]net, presented a form asking for the server address, username, and password. These fields matched the information required by the genuine client, lending credibility to the request. When victims submitted the form, the data was transmitted to a separate domain, watchguard-ssl[.]online, where attackers stored the credentials for potential use against the organization’s network.
Huntress noted that the malicious script was designed to reject the first submission. The site cleared the input fields, prompting the victim to re-enter their information. This behavior potentially supplied attackers with multiple password attempts.
Software Authenticity as Concealment
After collecting the second set of credentials, the website initiated a download of the genuine Mobile VPN with SSL client version 12.11.5. The file was sourced from WatchGuard’s official content delivery network and carried a valid digital signature from WatchGuard Technologies. The signature included a timestamp dated November 4, 2025, which further reinforced the file’s legitimacy to the user.
Huntress verified that the installer remained unchanged after signing. Investigators found no evidence that attackers had modified the legitimate executable or bundled it with malware. By serving the authentic software, the operators ensured that victims would successfully install the client and likely never suspect that their credentials had been compromised during the process.
Timeline and Vendor Response
Huntress revealed that the operators registered the download domain on August 22, 2026. The credential collection domain, watchguard-ssl[.]online, appeared later on September 14. WatchGuard had previously reported the lookalike address in January, but researchers at that time found no functioning mechanism directing visitors through the fraudulent download process.
The source material notes that WatchGuard reported the address earlier, but the current investigation found the mechanism functioning. The delivery of genuine software helps conceal the credential theft, as stated by Huntress experts.
What should you do?
Organizations should monitor for unauthorized VPN connections and review logs for failed login attempts that may indicate credential harvesting. Administrators should verify download sources through official vendor portals rather than search engine results. Security teams should watch for unusual activity from managed service providers or remote workers who may have visited deceptive sites.
What to do and how to stay safe
- Verify all software downloads directly from the vendor’s official website or approved internal repositories, avoiding links from search engines or email.
- Monitor VPN server logs for failed authentication attempts followed by successful logins, which may indicate credential stuffing or replay attacks.
- Implement multi-factor authentication for all administrative VPN accounts to ensure stolen passwords alone cannot grant network access.
- Educate users to recognize that legitimate software installations do not require entering credentials into a web form before the download begins.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the fake site distribute malware?
No, the site delivered the genuine, signed WatchGuard Mobile VPN client version 12.11.5 from the official content
