Fake WatchGuard VPN site stole credentials before serving signed software

A fake WatchGuard VPN download site collected login details before directing visitors to the genuine, digitally signed installer, according to security researchers at Huntress. The approach could expose corporate networks without installing malware.

Huntress began investigating after detecting suspicious activity involving an administrator at a managed service provider. The administrator had searched Bing for a WatchGuard VPN download and visited watchguard-vpn[.]net, a lookalike site that requested a server address, username and password. The form sent those details to watchguard-ssl[.]online.

The site reportedly rejected the first submission and cleared the fields, prompting the visitor to enter the credentials again. After the second submission, it offered Mobile VPN with SSL client version 12.11.5 from WatchGuard’s official content delivery network. Huntress said the installer had a valid WatchGuard Technologies signature and showed no evidence of modification.

Huntress said the download domain was registered on August 22, 2026, and the credential-collection domain appeared on September 14. WatchGuard had reported the lookalike address in January, when researchers found no working mechanism for the fraudulent download process. The installer’s signature timestamp was November 4, 2025.

Huntress found no recorded download from the official server during the investigated incident, suggesting the user may not have completed both submissions. The alert came 21 seconds after the site loaded. The main deceptive domain was offline by October 13, though Huntress said that did not establish whether related infrastructure remained active elsewhere.