WatchGuard Phishing: Fake Domain Steals Admin Logins Twice Before Serving Signed VPN Client

Administrators installing WatchGuard VPN clients are at risk of having their login credentials stolen by a deceptive website that still delivers the legitimate software. Huntress security researchers identified this campaign after detecting suspicious activity involving a managed service provider administrator who searched for a download on Bing.

The attacker operated the domain watchguard-vpn.net, which displayed a form requesting the server address, username, and password. These fields matched the genuine installation process, making the request appear normal to users. After submission, the data was sent to watchguard-ssl.online, where attackers collected the information for potential use against the organization’s network.

How the deception works

The malicious script rejected the initial form submission and cleared the fields, prompting the victim to re-enter their credentials. This tactic allowed attackers to capture multiple password attempts. According to Huntress, the download domain was registered on August 22, 2026, while the credential collection domain appeared on September 14.

Who is affected

This threat targets system administrators and IT staff responsible for deploying VPN clients. The investigation began after Huntress detected activity from an administrator at a managed service provider. Any organization using WatchGuard Mobile VPN with SSL could be affected if staff visit the fraudulent site instead of the official vendor pages.

Our take on the response

WatchGuard had previously reported the lookalike address in January, though researchers then found no functioning mechanism for the fraudulent download. The current campaign is active and effective because it delivers the real software. Huntress verified that the installer was unchanged and carried a valid digital signature from WatchGuard Technologies.

For customers and users

Teams should verify the exact URL before entering any credentials during software installation. Look for subtle differences in domain names, such as extra hyphens or different top-level domains. If a form rejects your input and asks you to re-enter sensitive data, stop the process immediately. Check with your IT department to confirm the correct download source. Be wary of follow-up emails claiming your account is compromised, as attackers often use stolen credentials to launch phishing campaigns.

Background: VPNs

A virtual private network encrypts your internet traffic and routes it through a remote server. This masks your real IP address from the sites you visit. It protects data on public Wi-Fi but does not make you anonymous to the VPN provider itself.

Read the full guide: How VPNs Actually Work: A Plain English Explanation of Virtual Private Networks

What to do and how to stay safe: WatchGuard

• Verify the domain name of any download site against the official vendor URL before entering credentials.
• Use a password manager to detect if a login form is not the expected one for the application.
• Monitor network logs for unusual VPN connection attempts from unexpected locations or times.
• Rotate administrator passwords if you suspect you entered them on an unverified website.

Step-by-step guide: Incident Response Plans: How to Stop Damage When Attacks Happen

General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the fake site deliver malware?

No, the site delivered the genuine, digitally signed WatchGuard Mobile VPN client version 12.11.5, which Huntress confirmed was unmodified.

What information did the attackers steal?

Attackers collected VPN server addresses, usernames, and passwords from administrators who submitted the fraudulent form.

Is the fake website still active?

Huntress identified the campaign as active, with the download domain registered in August 2026 and the collection domain in September 2026.