Fake WatchGuard VPN Site Steals Corporate Credentials

Ender Öztürk

October 19, 2026

A sophisticated cyberattack campaign targeting corporate users has been uncovered, involving a deceptive website mimicking the official WatchGuard VPN download portal. Security researchers at Huntress identified that attackers are using a fraudulent domain, watchguard-vpn.net, to harvest sensitive credentials, including server addresses, usernames, and passwords. By masquerading as a legitimate software provider, the threat actors successfully tricked users into entering their credentials into a malicious form. The campaign, which was first detected after the suspicious domain registration in August 2026, represents a new breed of social engineering where the attacker provides the genuine software to avoid raising immediate suspicion from the victims.

Deceptive Methods are Employed by Attackers

The operation relies on a highly calculated series of steps to ensure users remain unaware of the credential theft. When a victim inputs their login information into the fake site, the data is transmitted to a secondary, attacker-controlled domain known as watchguard-ssl.online. To bypass basic security scrutiny, the fake form initially rejects the provided credentials, prompting the user to re-enter them. This secondary prompt allows the attackers to attempt multiple password combinations and verify the accuracy of the stolen data.

Once the deceptive process is complete, the website redirects the user to the genuine WatchGuard content delivery network. The resulting download is the authentic Mobile VPN with SSL client, version 12.11.5, which bears a valid digital signature from WatchGuard Technologies. Because the installation package remains untampered and verified, victims are unlikely to suspect that their system or account security has been compromised during the initial download phase.

Security Defenses are Challenged by New Tactics

This attack vector poses a significant challenge for traditional endpoint protection systems, which often fail to flag the activity because it occurs entirely within the web browser environment. By delivering legitimate, signed software, the attackers effectively bypass file-based integrity checks that typically trigger security alerts. The primary deceptive domain was reported as inactive by mid-October, yet the potential for long-term account compromise remains high due to the nature of the stolen information.

Organizations are advised to treat this incident as a critical security breach. The primary remediation strategy involves an immediate, organization-wide password reset for all VPN users. Furthermore, IT departments must prioritize the implementation of robust multi-factor authentication, which serves as a critical barrier against unauthorized access, even when credentials have been harvested. Administrators should also audit their network logs for any anomalies or suspicious login patterns that might indicate the use of these stolen credentials.

Proactive monitoring of VPN access logs and ensuring that all employees are directed exclusively to official software distribution channels are essential components of a secure infrastructure. As threat actors continue to evolve their methods by leveraging trust in reputable software brands, enterprises must remain vigilant and adopt a defense-in-depth posture.

Have you encountered any suspicious software download portals recently, or do you have suggestions for how companies can better train their employees to spot these sophisticated phishing attempts? Please share your thoughts and experiences in the comments section below.