Huntress Finds Fake WatchGuard Site Steals Credentials Before Serving Real Installer
Attackers used SEO poisoning to trick admins into entering VPN login details on a spoofed domain before downloading the legitimate client.
Key points
- Huntress researchers analyzed a campaign that harvested credentials via a fake WatchGuard download page before serving the genuine signed installer.
- The attack leveraged SEO poisoning to place lookalike domains like watchguard-vpn[.]net high in Bing search results for VPN client queries.
- Microsoft previously attributed the broader campaign to Storm-2561, a financially motivated threat actor active since May 2025 targeting multiple vendors.
Huntress researchers analyzed an incident in October involving a credential-harvesting campaign targeting WatchGuard VPN users. The group examined activity linked to the domain watchguard-vpn[.]net, which impersonated the vendor’s download portal to capture authentication data before redirecting victims to the real installer.
The investigation revealed that this iteration of the attack chain did not rely on delivering malicious executables. Instead, the spoofed website collected server addresses, usernames, and passwords through a browser prompt. After harvesting these credentials, the site triggered a download of the genuine WatchGuard Mobile VPN with SSL 12.11.5 installer from the official vendor CDN, leaving no obvious malware trace on the victim’s system.
Attack Mechanics and History
WatchGuard’s Secplicity team documented this broader campaign in January 2026, noting lookalike sites for WatchGuard, F5, Fortinet, SonicWall, and Sophos. Microsoft Threat Intelligence later linked the activity to Storm-2561, attributing the use of watchguard-vpn[.]com to this financially motivated actor. Earlier iterations involved fake .NET executables that sent credentials to command-and-control servers before showing installation errors.
The October iteration observed by Huntress differed by removing the malicious binary from the download flow. The spoofed page used unobfuscated JavaScript to package submitted credentials into JSON and send them to a separate collector domain. The script deliberately rejected the first submission to prompt users to re-enter data. This could capture corrected credentials, although that intent remains an analytical assessment.
Search Engine Poisoning
The lure relied on search engine optimization poisoning rather than paid malicious advertising. An administrator at a managed service provider searched Bing for "watchguard vpn sll download" and clicked the result eight seconds later. The click passed through a standard Bing redirect parameter, indicating the domain had manipulated search rankings to appear as a legitimate resource for users seeking VPN clients.
Huntress noted that Bing’s Copilot had previously recommended watchguard-vpn[.]net for similar queries, although the domain lacked backend logic to serve the phishing page at that earlier time. The lookalike site included product information and FAQs to bolster its appearance and search ranking. The domain was offline as of October 13, after Huntress notified WatchGuard and shared infrastructure details.
What should you do?
Security teams should monitor for unauthorized VPN access attempts using harvested credentials, as attackers now collect valid login data without installing malware. Organizations should verify that employees are using official vendor URLs for software downloads rather than relying solely on search engine results. Administrators should review search result placements for critical infrastructure tools and consider bookmarking legitimate download portals to reduce exposure to SEO poisoning.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: WatchGuard
- Verify the authenticity of software download sources by checking official vendor documentation or bookmarks instead of clicking search results.
- Monitor VPN logs for unusual login attempts or connections from unexpected locations that may indicate the use of stolen credentials.
- Train users to recognize lookalike domains and verify SSL certificates and URL structures before entering sensitive authentication information.
- Implement multi-factor authentication for VPN access to mitigate the impact of credential theft even if passwords are compromised.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this attack install malware on the victim's computer?
No, the latest iteration downloads the legitimate, digitally signed WatchGuard installer after stealing credentials in the browser.
Which threat actor is behind this campaign?
Microsoft attributed the broader campaign to Storm-2561, a financially motivated actor active since May 2025.
How did attackers get victims to visit the fake site?
Attackers used SEO poisoning to place lookalike domains like watchguard-vpn[.]net high in Bing search results for VPN download queries.
