Did your team hand over VPN credentials to a fake WatchGuard download site?

The short version

• Huntress identified a phishing operation targeting managed service provider administrators.
• The scheme captured login details while delivering legitimate software to avoid suspicion.
• Attackers forced re-entry of credentials to gather multiple password variations.

The details

Security researchers at Huntress traced the campaign to a domain registered on 22 August 2026. The site, watchguard-vpn.net, mimicked the vendor’s official download pages for mobile connectivity. Users searching for the client on Bing were directed to this deceptive interface. The page displayed a form requesting the server address, username and password, mirroring the genuine setup process. Submission sent these details to a separate domain, watchguard-ssl.online, where operators stored the data. The script then rejected the first entry, clearing the fields to prompt a second submission. This tactic potentially provided attackers with multiple password attempts for the same account.

The context

The operation relied on delivering authentic software to maintain cover. After the second credential submission, the site initiated a download from WatchGuard’s official content delivery network. The file was Mobile VPN with SSL client version 12.11.5, bearing a valid digital signature from WatchGuard Technologies. The timestamp on the signature was dated 4 November 2025. Huntress confirmed the installer remained unchanged after signing, finding no evidence of modification. WatchGuard had previously reported the lookalike address in January, though researchers found no functioning mechanism at that time.

Next steps

Teams should verify if any administrators recently visited lookalike domains for software updates. Check proxy logs for connections to watchguard-vpn.net or watchguard-ssl.online. If exposure is confirmed, treat the associated VPN server credentials as compromised. Rotate all administrative passwords immediately and review authentication logs for anomalous login attempts from untrusted locations.

What defenders should look for

Security operations teams usually notice this activity through unusual outbound HTTPS traffic to newly registered domains. Check whether users are submitting credentials to web forms that do not match known vendor endpoints. Look for repeated failed form submissions followed by successful downloads, which may indicate automated credential harvesting. Verify that software downloads originate from official content delivery networks rather than intermediary hosts. Monitor for administrative logins from unexpected IP addresses shortly after a user downloads software.

What to do and how to stay safe: WatchGuard

• Audit recent web requests for visits to domains resembling vendor names but with different top-level domains.
• Force password resets for any administrator accounts used during the timeframe of the suspected exposure.
• Enable multi-factor authentication on all VPN administrative interfaces to mitigate credential theft risks.
• Review proxy and DNS logs for connections to domains registered recently that mimic official software portals.

Step-by-step guide: Password Manager Security Checklist: Hardening Your Vault

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the fake site deliver malware?

No, Huntress verified that the site delivered the authentic, digitally signed WatchGuard Mobile VPN client.

How did the attackers hide the theft?

They served legitimate software from the official content delivery network after collecting credentials.

When was the malicious domain registered?

Huntress found the download domain was registered on 22 August 2026.