WatchGuard VPN Credential Theft via SEO-Poisoned Fake Download Sites

Managed service provider administrators and IT staff searching for legitimate software downloads are facing a sophisticated credential theft campaign targeting WatchGuard VPN accounts. Attackers created a convincing fake website that harvested login credentials directly from the browser before serving the genuine, digitally signed WatchGuard installer, leaving victims with working software but compromised access rights.

According to research published by Huntress, the campaign relied on SEO poisoning to elevate the malicious domain watchguard-vpn[.]net in search engine results. When users clicked through from Bing, they encountered a page titled "WatchGuard Firebox VPN Client" that prompted them to enter their server address, username, and password before the download could proceed.

How the Attack Works

The deception relied on mimicking legitimate vendor behavior to lower user suspicion. The fake site presented a standard connection prompt, which appeared necessary for configuring the VPN client. Once the user submitted their credentials, the site intercepted the data and sent it to an attacker-controlled server while simultaneously triggering the download of the official WatchGuard Mobile VPN with SSL 12.11.5 installer from the vendor's CDN.

This method ensures the victim receives functional software, reducing the likelihood of immediate suspicion or reporting. The attackers captured the credentials in JSON format via JavaScript, labeling submissions to track attempts. If the first entry failed validation, the script cleared the fields and encouraged a second attempt, potentially capturing corrected passwords or alternative credentials in the process.

Who Is Affected

The primary targets are administrators and IT personnel responsible for deploying or troubleshooting WatchGuard VPN solutions. Huntress detected the incident when an MSP administrator searched for "watchguard vpn sll download" on Bing and clicked the result within eight seconds. The campaign previously targeted other VPN providers, including F5, Fortinet, SonicWall, and Sophos, according to earlier research by WatchGuard’s Secplicity team and Microsoft Threat Intelligence.

Microsoft attributed the broader campaign to Storm-2561, a financially motivated threat actor active since May 2025. The group has a history of pushing spoofed vendor sites up search results and using signed malicious installers to sideload DLLs, though this specific iteration focused on browser-based credential harvesting rather than malware execution.

Our take on the response

Huntress notified WatchGuard about the active campaign and shared infrastructure details prior to publishing their findings. As of October 13, the main domain involved in the Huntress-observed incident was offline. However, the use of legitimate vendor files and SEO manipulation makes this attack particularly difficult to detect through traditional antivirus signatures or simple URL checks.

For customers and users

Teams should verify that any software download originates from the official vendor website rather than a search engine result page. Users should check whether they have entered VPN credentials into a browser dialog box instead of the native application interface. Administrators should monitor for unusual login attempts from unexpected locations or times, which may indicate stolen credentials are being tested. Staff should recognize that legitimate installers do not require password entry before downloading, and any prompt for authentication during the download phase is a strong indicator of a phishing attempt.

Background: VPNs

A virtual private network encrypts your internet traffic and routes it through a remote server. This masks your real IP address from the sites you visit. It protects data on public Wi-Fi but does not make you anonymous to the VPN provider itself.

Read the full guide: How VPNs Actually Work: A Plain English Explanation of Virtual Private Networks

What to do and how to stay safe: WatchGuard

• Bookmark the official vendor download page to avoid relying on search engine results for future software updates or installations.
• Review VPN server logs for successful logins originating from unfamiliar IP addresses or geographic locations shortly after any download activity.
• Enforce multi-factor authentication on all VPN accounts to ensure that stolen passwords alone cannot grant unauthorized access to the network.
• Train staff to recognize that configuration prompts should appear within the installed application, not in a web browser before the software is installed.

Step-by-step guide: Incident Response Plans: How to Stop Damage When Attacks Happen

General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did this attack install malware on the victim's computer?

No, the attackers served the legitimate, signed WatchGuard installer, so no malicious executable was installed on the victim's machine.

Which search engine was used to distribute the fake site?

The campaign relied on Bing search results, with victims clicking through standard Bing redirect links to reach the spoofed domain.

Is the fake website still active?

Huntress reported that the primary domain watchguard-vpn[.]net was offline as of October 13, following the detection of the incident.