/
← Voltar ao feed
high managed service providers technology

SEO-poisoning campaign uses fake WatchGuard VPN download site to steal SSL VPN credentials, then serves the genuine signed client

1 fonte(s) · 1 atualização(ões) · publicado 14/10/2026 07:50 · coletado há 4 dias

Huntress researchers detailed an SEO-poisoning campaign on 13 October that harvests SSL VPN credentials through a lookalike WatchGuard download page, watchguard-vpn[.]net, and then delivers the legitimate, validly signed Mobile VPN with SSL installer. Earlier waves used trojanised installers, but this iteration contains no malware, so endpoint tools have nothing to flag. The investigated incident began on 7 October, when an administrator at a managed service provider searched Bing for a WatchGuard VPN download and reached the fake site through a standard Bing result redirect. Microsoft attributed related activity to Storm-2561, a financially motivated actor active since May 2025. Huntress could not establish whether the same operators controlled both the lure and collector domain registrations. The lure domain was offline as of 13 October.

Detalhes técnicos

  • Clicking any download option opens a pop-up requesting the VPN server address, username and password, the same three values the real client asks for.
  • About 150 lines of unobfuscated JavaScript (popup.js) post the entries as JSON to the collector domain watchguard-ssl[.]online.
  • The first submission always returns an "incorrect data" error, so victims retype their credentials and the operators likely get a more accurate second set plus the server address.
  • After the second submission, the script downloads the genuine WatchGuard Mobile VPN with SSL installer (version 12.11.5) from cdn.watchguard.com. Huntress verified the Authenticode signature from WatchGuard Technologies and confirmed the binary was unaltered.
  • Detection was thin: as of 8 October only seven VirusTotal vendors flagged the lure domain and two flagged the collector.
  • WatchGuard's Secplicity team first reported watchguard-vpn[.]net in January, as part of a wider credential-harvesting campaign spoofing WatchGuard, F5, Fortinet, SonicWall and Sophos clients, when the domain had no working backend. WHOIS data shows re-registration on 22 August, with the collector domain registered on 14 September.
  • Huntress flagged the activity 21 seconds after the site loaded, and browser history suggests the user did not complete both submission rounds. Huntress shared infrastructure details with WatchGuard.

Remediação

  • Reset passwords for any account entered on the site and treat the associated VPN endpoint as known to the attacker.
  • Enforce MFA on SSL VPN access.
  • Monitor for VPN logins from hosting providers, unfamiliar ASNs or new countries.
  • Block watchguard-vpn[.]net, watchguard-ssl[.]online, 80.249.132[.]140 and 158.94.209[.]19.
  • Publish and bookmark official download links such as software.watchguard.com.

Linha do tempo

  1. itsecurityguru.org ↗ · pub. 14/10/2026 07:50 · coletado 19/10 17:55 primeiro registro

    SEO-poisoning campaign uses fake WatchGuard VPN download site to steal SSL VPN credentials, then serves the genuine signed client

    ler a análise desta fonte

    Huntress researchers detailed an SEO-poisoning campaign on 13 October that harvests SSL VPN credentials through a lookalike WatchGuard download page, watchguard-vpn[.]net, and then delivers the legitimate, validly signed Mobile VPN with SSL installer. Earlier waves used trojanised installers, but this iteration contains no malware, so endpoint tools have nothing to flag. The investigated incident began on 7 October, when an administrator at a managed service provider searched Bing for a WatchGuard VPN download and reached the fake site through a standard Bing result redirect. Microsoft attributed related activity to Storm-2561, a financially motivated actor active since May 2025. Huntress could not establish whether the same operators controlled both the lure and collector domain registrations. The lure domain was offline as of 13 October.

    Technical Details

    • Clicking any download option opens a pop-up requesting the VPN server address, username and password, the same three values the real client asks for.
    • About 150 lines of unobfuscated JavaScript (popup.js) post the entries as JSON to the collector domain watchguard-ssl[.]online.
    • The first submission always returns an "incorrect data" error, so victims retype their credentials and the operators likely get a more accurate second set plus the server address.
    • After the second submission, the script downloads the genuine WatchGuard Mobile VPN with SSL installer (version 12.11.5) from cdn.watchguard.com. Huntress verified the Authenticode signature from WatchGuard Technologies and confirmed the binary was unaltered.
    • Detection was thin: as of 8 October only seven VirusTotal vendors flagged the lure domain and two flagged the collector.
    • WatchGuard's Secplicity team first reported watchguard-vpn[.]net in January, as part of a wider credential-harvesting campaign spoofing WatchGuard, F5, Fortinet, SonicWall and Sophos clients, when the domain had no working backend. WHOIS data shows re-registration on 22 August, with the collector domain registered on 14 September.
    • Huntress flagged the activity 21 seconds after the site loaded, and browser history suggests the user did not complete both submission rounds. Huntress shared infrastructure details with WatchGuard.

    Remediation

    • Reset passwords for any account entered on the site and treat the associated VPN endpoint as known to the attacker.
    • Enforce MFA on SSL VPN access.
    • Monitor for VPN logins from hosting providers, unfamiliar ASNs or new countries.
    • Block watchguard-vpn[.]net, watchguard-ssl[.]online, 80.249.132[.]140 and 158.94.209[.]19.
    • Publish and bookmark official download links such as software.watchguard.com.