WatchGuard VPN Users Targeted by Credential Stealing Phishing Site

Key Takeaways

• A sophisticated phishing campaign targeted WatchGuard VPN users through a fake download website.
• Attackers leveraged search engine optimization (SEO) poisoning to direct users to the malicious site.
• The phishing site harvested VPN server addresses, usernames, and passwords directly in the browser via a pop-up.
• Victims were then provided with a legitimate, digitally signed WatchGuard VPN installer (version 12.11.5), masking the credential theft.
• Organizations are urged to reset affected credentials, enforce MFA, and direct users to official software portals.

WatchGuard VPN Users Targeted by Credential Stealing Phishing Site

Cybersecurity researchers have uncovered a new phishing operation employing a deceptive WatchGuard VPN download portal to illicitly acquire user login credentials. This campaign ingeniously presents a genuine, digitally signed VPN installer to victims after successfully exfiltrating their sensitive information, making detection challenging.

Phishing Campaign Details Emerge

The attack flow involves a user searching for WatchGuard VPN software and landing on a meticulously crafted fake website. This site is designed to mimic the official WatchGuard branding and support infrastructure. Instead of delivering a malicious client, the site prompts users with a browser pop-up requesting their VPN server address, username, and password. This critical information is stolen before any software is downloaded, leaving victims compromised without ever interacting with a malicious file.

This incident highlights a growing trend of search engine poisoning, where threat actors manipulate search rankings to push their malicious sites into prominent positions. Such tactics can mislead users who rely on search engine results for software downloads, blurring the lines between legitimate and fraudulent sources.

Researchers from Huntress identified this credential harvesting scheme during an investigation into an incident affecting an administrator at a managed service provider (MSP) on October 7. Their subsequent report, published on October 13, detailed how the phishing attack primarily focused on in-browser credential theft rather than distributing malware-laden installers.

How the Credential Theft Worked

The compromised administrator reportedly used Bing to search for “watchguard vpn sll download,” subsequently navigating to the fake website within seconds. Analysis of the browsing history indicated that search engine optimization (SEO) poisoning, rather than paid malicious advertisements, was the likely vector for directing the victim to the fraudulent site.

The phishing landing page meticulously replicated WatchGuard’s branding, product details, and even included a FAQ section to enhance its legitimacy. A prominent download button led to a fabricated support page offering various client downloads. Despite a footer indicating it was an “independent fan site,” the overall presentation strongly suggested an official support service. Upon attempting to download any client, a pop-up appeared, asking for the VPN Server, Login, and Password – fields identical to those required for a standard VPN connection, making the request appear routine. This technique mirrors prior fake Ivanti download sites, though those campaigns typically delivered altered installers, whereas this WatchGuard operation focused on browser-based credential capture.

The credential collection mechanism was implemented using approximately 150 lines of JavaScript. This script captured the entered details, formatted them into JSON, and transmitted them via an HTTP POST request to a separate collection server. Each submission was tagged to indicate whether it was a first or second attempt.

Intriguingly, the script was configured to always reject the initial submission, clearing the fields and displaying an “Incorrect data” message. This tactic is designed to encourage victims to re-enter their credentials, potentially correcting a typo or trying a different password, thereby providing attackers with multiple sets of login information.

After the second submission, a success message would appear, and a hidden link would initiate the download of WatchGuard Mobile VPN with SSL version 12.11.5 directly from WatchGuard’s official content delivery network. Huntress confirmed that this downloaded installer bore a valid digital signature and had not been tampered with. This contrasts with earlier VPN credential theft operations, such as those linked by Microsoft to Storm-2561, which involved fake installers and malicious DLLs before directing users to genuine software.

While Huntress could not definitively link the operators of the current campaign to previous instances where the phishing domain had been reused, the investigation into the MSP incident showed no record of a download from WatchGuard’s CDN in the administrator’s browser history. This suggests the administrator may not have completed both credential prompts, though a single submission remained plausible. Managed Defender flagged the suspicious activity within 21 seconds of the page loading, enabling responders to provide timely remediation guidance.

The malicious domain was taken offline by October 13.

What You Should Do

• Reset Passwords: Immediately reset any VPN passwords that may have been exposed through this phishing attempt.
• Assume Compromise: Treat any submitted VPN server addresses as known to attackers.
• Enforce MFA: Implement and strictly enforce multifactor authentication (MFA) for all VPN access to add a critical layer of security.
• Review VPN Logs: Scrutinize VPN login logs for any unusual or unauthorized access attempts.
• Bookmark Official Sites: Educate staff to use bookmarked links to the official WatchGuard software portal or other vendor download pages, rather than relying on search engine results for software downloads.
• Verify Digital Signatures: While a valid installer signature is crucial, remember that it does not guarantee the safety of the website from which it was downloaded, especially regarding credential handling.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.