Fake VPN download site steals administrator credentials to give attackers direct access to corporate networks — but delivers official signed software so victims never suspect a thing

Fake WatchGuard VPN website steals administrator credentials while delivering legitimate software Attackers collected VPN server addresses, usernames, and passwords The fraudulent website rejected initial submissions to collect credentials a second time A fraudulent WatchGuard download website stole

<![CDATA[ <article> <ul><li><strong>Fake WatchGuard VPN website steals administrator credentials while delivering legitimate software</strong></li><li><strong>Attackers collected VPN server addresses, usernames, and passwords</strong></li><li><strong>The fraudulent website rejected initial submissions to collect credentials a second time</strong></li></ul><p>A fraudulent WatchGuard download website stole VPN login details while supplying the authentic installation package, experts have claimed.</p><p>Security investigators at Huntress traced the activity to a lookalike domain that collected connection details before downloading the legitimate client.</p><p>The <a href="https://www.huntress.com/blog/fake-watchguard-vpn-credential-phishing" target="_blank" rel="nofollow">investigation began</a> after suspicious activity involving an administrator working for a managed service provider was detected.</p><h2 id="fake-download-pages-harvest-user-credentials">Fake download pages harvest user credentials</h2><p>Investigators found that the user had searched Bing for a WatchGuard VPN download before visiting a deceptive website designed to resemble the vendor's official download pages.</p><p>The website, watchguard-vpn[.]net, offered a purported <a href="https://www.techradar.com/vpn/best-mobile-vpn">mobile VPN</a> with SSL download and displayed a form requesting the server address, username, and password.</p><p>Those details matched information required by the genuine <a href="https://www.techradar.com/vpn/best-vpn">VPN</a> client, making the request appear consistent with an ordinary installation process.</p><p>Submitting the form transmitted the information to a separate domain, watchguard-ssl[.]online, where attackers collected the credentials for potential use against the organization's network.</p><p>The malicious script rejected the first submission and cleared the fields, prompting the victim to enter the information again and potentially supplying attackers with multiple password attempts.</p><p>Huntress revealed that the operators registered the download domain on August 22, 2026, while the credential collection domain appeared on September 14.</p><p>WatchGuard had previously reported the lookalike address in January, although researchers then found no functioning mechanism directing visitors through the fraudulent download process.</p><h2 id="genuine-software-helps-conceal-the-credential-theft">Genuine software helps conceal the credential theft</h2><p>After collecting the second submission, the website initiated a download from WatchGuard's official content delivery network rather than providing a counterfeit installation package.</p><p>The file was Mobile VPN with SSL client version 12.11.5, carrying a valid digital signature from WatchGuard Technologies and a timestamp dated November 4, 2025.</p><p>Huntress verified that the installer remained unchanged after signing, meaning investigators found no evidence that attackers had modified the legitimate executable. </p><p>This approach differs from campaigns that distribute tampered installers or malicious libraries, which <a href="https://www.techradar.com/news/best-endpoint-security-software">endpoint protection</a> products may identify through file inspection.</p><p>The authentic download also gives victims little reason to suspect their credentials have already been compromised, since installation can proceed normally afterward.</p><p>Huntress found no recorded download from the official server during the investigated incident, suggesting the user might not have completed both credential submissions.</p><p>The detection arrived 21 seconds after the malicious website loaded, allowing the security operations team to provide remediation guidance before investigators observed further escalation.</p><p>Huntress reported that the main deceptive domain was offline by October 13, although that status does not establish whether associated infrastructure remains active elsewhere.</p><p>The attack avoids many <a href="https://www.techradar.com/best/best-malware-removal">malware</a> checks because the fake website steals VPN credentials through the <a href="https://www.techradar.com/best/browser">browser</a> before downloading the genuine software.</p><p>Organizations should reset compromised passwords, enable multifactor authentication, check for suspicious VPN logins, and direct employees to official software download pages.</p><figure class="van-image-figure inline-layout" data-bordeaux-image-check ><div class='image-full-width-wrapper'><div class='image-widthsetter' style="max-width:676px;"><p class="vanilla-image-block" style="padding-top:31.51%;"><img id="diM9tpwF2Lz85R8q85CT78" name="tr-g_news" alt="Google logo on a black background next to text reading 'Click to follow TechRadar'" src="https://cdn.mos.cms.futurecdn.net/diM9tpwF2Lz85R8q85CT78-1920-80.jpg" mos="" align="middle" fullscreen="" width="676" height="213" attribution="" endorsement="" class="inline"></p></div></div></figure> </article> ]]>