/
← Voltar ao feed
high managed service providers technology

Fake WatchGuard VPN site watchguard-vpn[.]net harvests VPN credentials, then serves the genuine signed installer

1 fonte(s) · 1 atualização(ões) · publicado 13/10/2026 18:00 · coletado há 11 horas

Huntress analyzed an active credential-phishing campaign in which the lookalike domain watchguard-vpn[.]net harvests WatchGuard SSL VPN credentials. On October 7, 2026, an administrator at a managed service provider searched Bing for "watchguard vpn sll download" and clicked through to the fake page, which Huntress classifies as SEO poisoning. This iteration differs from earlier reporting by WatchGuard Secplicity (January 2026) and Microsoft Threat Intelligence (Storm-2561) because it delivers no malware. After credentials are captured, the victim receives the legitimate, validly signed WatchGuard installer from WatchGuard's own CDN. Huntress Managed Defender flagged the activity 21 seconds after the page loaded, and the SOC provided remediation before escalation. The lure domain was offline as of October 13, and Huntress notified WatchGuard.

Technical Details

  • The lure site is titled "WatchGuard Firebox VPN Client" and carries an "independent fan site" disclaimer. The download page is watchguard-vpn[.]net/index.php.
  • Clicking any download option triggers a pop-up that asks for Server, Login and Password. The logic is in about 150 lines of unobfuscated JavaScript, popup.js.
  • Input is sent as JSON, tagged with an attempt number, to watchguard-ssl[.]online. Fetch failures are swallowed silently.
  • The first submission is always rejected with "Incorrect data, please enter again", which yields a second set of credentials to validate. The Server field gives the attacker the VPN gateway address.
  • After the second submission, the script downloads WG-MVPN-SSL_12_11_5.exe from cdn.watchguard.com. It is an Inno Setup installer, version 12.11.5, signed by WatchGuard Technologies via Sectigo, and its Authenticode digest verified as unmodified.
  • In the observed case, no download was recorded, which suggests the user did not complete both rounds. They may still have entered credentials in the first round.
  • watchguard-vpn[.]net was registered on 2026-08-22 (Realtime Register B.V.) and resolves to 80.249.132[.]140 (Site BV/LeaseWeb NL, AS60781). In January it resolved to 74.208.236[.]39. Huntress could not establish whether the same operators controlled both registrations.
  • watchguard-ssl[.]online was registered on 2026-09-14 (Dynadot) and resolves to 158.94.209[.]19 (Omegatech LTD, AS202412, Amsterdam).
  • As of October 8, only seven VirusTotal vendors flagged the lure domain and two flagged the collector.

Remediation

  • Reset passwords for any account that may have entered credentials, and treat the associated VPN endpoint as known to the attacker.
  • Enforce MFA on VPN accounts.
  • Monitor SSL VPN logins from hosting providers, unfamiliar ASNs or unusual countries.
  • Block watchguard-vpn[.]net, watchguard-ssl[.]online and the listed IPs.
  • Publish and bookmark official VPN client download links, such as software.watchguard.com, in client documentation.

Linha do tempo

  1. huntress.com ↗ · pub. 13/10/2026 18:00 · coletado 20/10 16:30 primeiro registro

    Fake WatchGuard VPN site watchguard-vpn[.]net harvests VPN credentials, then serves the genuine signed installer

    ler a análise desta fonte

    Huntress analyzed an active credential-phishing campaign in which the lookalike domain watchguard-vpn[.]net harvests WatchGuard SSL VPN credentials. On October 7, 2026, an administrator at a managed service provider searched Bing for "watchguard vpn sll download" and clicked through to the fake page, which Huntress classifies as SEO poisoning. This iteration differs from earlier reporting by WatchGuard Secplicity (January 2026) and Microsoft Threat Intelligence (Storm-2561) because it delivers no malware. After credentials are captured, the victim receives the legitimate, validly signed WatchGuard installer from WatchGuard's own CDN. Huntress Managed Defender flagged the activity 21 seconds after the page loaded, and the SOC provided remediation before escalation. The lure domain was offline as of October 13, and Huntress notified WatchGuard.

    Technical Details

    • The lure site is titled "WatchGuard Firebox VPN Client" and carries an "independent fan site" disclaimer. The download page is watchguard-vpn[.]net/index.php.
    • Clicking any download option triggers a pop-up that asks for Server, Login and Password. The logic is in about 150 lines of unobfuscated JavaScript, popup.js.
    • Input is sent as JSON, tagged with an attempt number, to watchguard-ssl[.]online. Fetch failures are swallowed silently.
    • The first submission is always rejected with "Incorrect data, please enter again", which yields a second set of credentials to validate. The Server field gives the attacker the VPN gateway address.
    • After the second submission, the script downloads WG-MVPN-SSL_12_11_5.exe from cdn.watchguard.com. It is an Inno Setup installer, version 12.11.5, signed by WatchGuard Technologies via Sectigo, and its Authenticode digest verified as unmodified.
    • In the observed case, no download was recorded, which suggests the user did not complete both rounds. They may still have entered credentials in the first round.
    • watchguard-vpn[.]net was registered on 2026-08-22 (Realtime Register B.V.) and resolves to 80.249.132[.]140 (Site BV/LeaseWeb NL, AS60781). In January it resolved to 74.208.236[.]39. Huntress could not establish whether the same operators controlled both registrations.
    • watchguard-ssl[.]online was registered on 2026-09-14 (Dynadot) and resolves to 158.94.209[.]19 (Omegatech LTD, AS202412, Amsterdam).
    • As of October 8, only seven VirusTotal vendors flagged the lure domain and two flagged the collector.

    Remediation

    • Reset passwords for any account that may have entered credentials, and treat the associated VPN endpoint as known to the attacker.
    • Enforce MFA on VPN accounts.
    • Monitor SSL VPN logins from hosting providers, unfamiliar ASNs or unusual countries.
    • Block watchguard-vpn[.]net, watchguard-ssl[.]online and the listed IPs.
    • Publish and bookmark official VPN client download links, such as software.watchguard.com, in client documentation.