Fake VPN download site steals administrator credentials to give attackers direct access to corporate networks — but delivers official signed software so victims never suspect a thing

Attackers built a look‑alike WatchGuard VPN portal that handed out the genuine client while siphoning administrator server addresses, usernames, and passwords, giving threat actors a direct foothold in corporate networks; any IT leader who trusts a single download source must reassess that trust.

How the Fake Download Page Masqueraded as Official Software

The counterfeit site, watchguard-vpn.net, copied the layout of WatchGuard’s legitimate download portal and offered a “mobile VPN with SSL” package that appeared indistinguishable from the real offering. By serving the authentic installation executable, the page avoided the typical red flags that users associate with malicious binaries.

Because the binary matched the expected checksum and digital signature, endpoint protection tools saw no anomaly, allowing the malicious front‑end to operate silently. This tactic exploits the assumption that a signed client guarantees a safe installation process.

Huntress investigators noted that the fraudulent domain was registered on August 22, 2026, a date that predates most public alerts, giving the operators a window to harvest credentials before security teams could respond.

The Double‑Submission Trick to Multiply Credential Harvest

When a victim entered VPN server details, the form posted the data to a second domain, watchguard-ssl.online, where the information was stored for later abuse. The script then deliberately rejected the first submission, cleared the fields, and prompted a second entry.

This forced‑re‑entry technique serves two purposes: it confirms that the victim’s credentials are valid and it generates multiple credential sets for brute‑force testing. Attackers can thus prioritize accounts with repeated submissions, increasing the likelihood of successful lateral movement.

The approach also creates noise that can mask the initial theft, as security logs may only show a failed form submission rather than a successful credential exfiltration.

Domain Registration Timeline Reveals Monitoring Gaps

WatchGuard reported the look‑alike address in January, yet investigators found no active redirect at that time, suggesting the domain lay dormant until the August registration. The credential‑collection domain appeared later on September 14, 2026, indicating a staged rollout.

This staggered deployment points to a deliberate evasion of domain‑watch services that flag newly registered look‑alikes. By waiting months, the attackers reduced the chance of early detection by automated brand‑protection tools.

The timeline underscores a broader issue: organizations often rely on vendor advisories without cross‑checking newly registered domains, leaving a blind spot that sophisticated actors can exploit.

What This Actually Means For You

1. Never trust a download link solely because the binary is signed; verify the hosting domain against official vendor listings.
2. Credential forms that request VPN server addresses, usernames, and passwords are likely phishing traps, especially if the URL deviates from the vendor’s known domain.
3. Repeated prompts for the same information suggest a script designed to harvest multiple attempts, a red flag for credential theft.
4. Monitor newly registered domains that mimic your critical vendors; early detection can block the first wave of credential collection.
5. Maintain separate, privileged accounts for VPN administration and enforce MFA to limit the impact of any stolen credentials.

Immediate Action Steps

Cross‑reference any WatchGuard VPN download URL with the official watchguard.com resource page before execution; if the domain differs, abort the download and report the site to both WatchGuard and your security vendor. Update internal documentation to list the exact authorized download domains and circulate the list to all administrators.

Enable multi‑factor authentication on all VPN administrator accounts and enforce password rotation policies that invalidate credentials within 30 days of any suspicious activity. Deploy network‑level monitoring for outbound connections to unknown domains such as watchguard‑ssl.online, and alert on any successful TLS handshakes to such addresses.

Frequently Asked Questions

What was the fake WatchGuard VPN site’s URL?

The malicious portal used the domain watchguard-vpn.net, which mimicked the legitimate WatchGuard download page but was registered by attackers on August 22, 2026.

How did the attackers collect VPN credentials?

After a user entered server address, username, and password, the form forwarded the data to a separate domain, watchguard‑ssl.online, where the information was stored for later exploitation.

Why did the form reject the first submission?

The script intentionally cleared the fields after the initial entry, forcing the victim to submit the credentials again; this generated multiple credential sets and confirmed their validity.

What Do You Think?

Given that a signed client can be weaponized by a fraudulent front‑end, should enterprises shift from trusting download URLs to requiring cryptographic verification of the source domain itself?