Fake WatchGuard download site harvests VPN credentials from MSP admin before serving legitimate signed installer
Huntress researchers identified a fake page impersonating the WatchGuard download portal that harvested VPN server addresses, usernames and passwords before offering the legitimate Mobile VPN with SSL installer. The investigation began after suspicious activity involving an administrator at a managed service provider (MSP), who found the page through a Bing search for the WatchGuard VPN download. The campaign targets corporate network access credentials, which could be used to try to breach the victim organization's network.
Detalhes técnicos
- The page asked for the VPN server address, username and password, as the legitimate client does, then sent them to a separate attacker-controlled domain.
- The form rejected the first submission and cleared the fields, prompting the victim to enter the credentials a second time and giving the attackers more than one capture attempt.
- After collection, the site pulled the installer (version 12.11.5) directly from WatchGuard's official CDN. It carried a valid WatchGuard Technologies signature dated 4 November 2025 and was unmodified, which lowers suspicion and avoids endpoint detection of tampered binaries.
- The download domain was registered on 22 August 2026 and the credential-harvesting domain on 14 September 2026. WatchGuard had reported a similar address in January, but Huntress found no functional mechanism then.
- No download was recorded on the official server during the analyzed incident, suggesting the user may not have completed both submissions. The SOC was alerted 21 seconds after the page loaded.
- The main fraudulent domain was offline on 13 October, but this does not confirm that the related infrastructure was taken down.
Remediação
- Reset potentially compromised passwords and enable multi-factor authentication.
- Review VPN logs for suspicious access.
- Instruct employees to obtain software only from official vendor pages.
Linha do tempo
-
Fake WatchGuard download site harvests VPN credentials from MSP admin before serving legitimate signed installer
ler a análise desta fonte ocultar
Huntress researchers identified a fake page impersonating the WatchGuard download portal that harvested VPN server addresses, usernames and passwords before offering the legitimate Mobile VPN with SSL installer. The investigation began after suspicious activity involving an administrator at a managed service provider (MSP), who found the page through a Bing search for the WatchGuard VPN download. The campaign targets corporate network access credentials, which could be used to try to breach the victim organization's network.
Technical Details
- The page asked for the VPN server address, username and password, as the legitimate client does, then sent them to a separate attacker-controlled domain.
- The form rejected the first submission and cleared the fields, prompting the victim to enter the credentials a second time and giving the attackers more than one capture attempt.
- After collection, the site pulled the installer (version 12.11.5) directly from WatchGuard's official CDN. It carried a valid WatchGuard Technologies signature dated 4 November 2025 and was unmodified, which lowers suspicion and avoids endpoint detection of tampered binaries.
- The download domain was registered on 22 August 2026 and the credential-harvesting domain on 14 September 2026. WatchGuard had reported a similar address in January, but Huntress found no functional mechanism then.
- No download was recorded on the official server during the analyzed incident, suggesting the user may not have completed both submissions. The SOC was alerted 21 seconds after the page loaded.
- The main fraudulent domain was offline on 13 October, but this does not confirm that the related infrastructure was taken down.
Remediation
- Reset potentially compromised passwords and enable multi-factor authentication.
- Review VPN logs for suspicious access.
- Instruct employees to obtain software only from official vendor pages.