A spoofed WatchGuard VPN download page requested user credentials before offering the genuine installer, researchers found.
Key takeaways
- A fake WatchGuard VPN download page appeared in Bing search results
- The site collected VPN server addresses, usernames and passwords
- A second credential submission triggered a genuine, digitally signed WatchGuard installer
- The domain was offline by Oct. 13, but anyone who entered credentials should notify IT and reset affected passwords
A search result became a credential trap
Someone looking for a legitimate workplace VPN might not expect the danger to come before the download. Yet research published Oct. 13 by Huntress describes a counterfeit WatchGuard VPN portal designed to collect sensitive login information while ultimately providing the real software.
On Oct. 7, an administrator at a managed service provider clicked a result for a misspelled WatchGuard VPN search on Bing. The destination, watchguard-vpn[.]net, resembled a vendor download site. Huntress classified the approach as SEO poisoning: using search visibility, rather than malicious ads, to draw users toward fraudulent pages.
The real installer came after the theft
Selecting a download option opened a browser form asking for the VPN server address, username and password. Although the legitimate client asks for similar details when connecting, an unfamiliar website demanding them before a download is a red flag. The information was covertly transmitted to a separate collection domain, watchguard-ssl[.]online, potentially allowing attackers to attempt unauthorized VPN access.
The site rejected the first attempt even if the information was correct, pushing visitors to enter credentials again. On the second submission, its script initiated a genuine WatchGuard Mobile VPN with SSL download. Researchers verified the installer’s signature and integrity and concluded that the software itself had not been altered as there was no infected executable to expose the deception.
Why the warning still matters
Huntress found no record of the final download, suggesting the administrator did not complete both prompts. Its security team raised an alert just 21 seconds after the fraudulent page loaded. The researchers said the domain was offline by Oct. 13, but the technique could be reused anywhere.
WatchGuard had identified the lookalike domain in January as part of a wider campaign targeting VPN brands. Anyone who entered details on a suspicious page should alert their IT team, change affected passwords and request a review of VPN access logs. Ask IT to enforce multifactor authentication and obtain software through official download pages or a company-approved link. A valid software signature cannot authenticate the website that led you there.
