Fake VPN download site steals administrator credentials to give attackers direct access to corporate networks — but delivers official signed software so victims never suspect a thing

• Phony WatchGuard VPN site takes administrator qualifications while providing genuine software application
• Attackers gathered VPN server addresses, usernames, and passwords
• The deceptive site declined preliminary submissions to gather qualifications a 2nd time

A deceitful WatchGuard download site took VPN login information while providing the genuine setup plan, specialists have actually declared.

Security detectives at Huntress traced the activity to a lookalike domain that gathered connection information before downloading the genuine customer.

The examination started after suspicious activity including an administrator working for a handled provider was discovered.Phony download pages collect user qualificationsDetectives discovered that the user had actually browsed Bing for a WatchGuard VPN download before checking out a misleading site created to look like the supplier’s main download pages.

The site, watchguard-vpn[.]internet, provided a supposed mobile VPN with SSL download and showed a type asking for the server address, username, and password.

Those information matched info needed by the real VPN customer, making the demand appear constant with a regular setup procedure.

Sending the type transferred the details to a different domain, watchguard-ssl[.]online, where aggressors gathered the qualifications for possible usage versus the company’s network.

The harmful script turned down the very first submission and cleared the fields, triggering the victim to go into the details once again and possibly providing enemies with numerous password efforts.

Huntress exposed that the operators signed up the download domain on August 22, 2026, while the credential collection domain appeared on September 14.

WatchGuard had actually formerly reported the lookalike address in January, although scientists then discovered no operating system directing visitors through the deceptive download procedure.

Authentic software application assists hide the credential theftAfter gathering the 2nd submission, the site started a download from WatchGuard’s main material shipment network instead of offering a fake setup plan.

The file was Mobile VPN with SSL customer variation 12.11.5, bring a legitimate digital signature from WatchGuard Technologies and a timestamp dated November 4, 2025.

Huntress confirmed that the installer stayed the same after signing, suggesting private investigators discovered no proof that opponents had actually customized the genuine executable.

This technique varies from projects that disperse tampered installers or destructive libraries, which endpoint defense items might recognize through file examination.

The genuine download likewise offers victims little factor to believe their qualifications have actually currently been jeopardized, given that setup can continue usually later.

Huntress discovered no taped download from the main server throughout the examined occurrence, recommending the user may not have actually finished both credential submissions.

The detection got here 21 seconds after the harmful site packed, enabling the security operations group to supply removal assistance before detectives observed even more escalation.

Huntress reported that the primary misleading domain was offline by October 13, although that status does not develop whether associated facilities stays active somewhere else.

The attack prevents lots of malware checks due to the fact that the phony site takes VPN qualifications through the internet browser before downloading the real software application.

Organizations must reset jeopardized passwords, allow multifactor authentication, look for suspicious VPN logins, and direct workers to main software application download pages.

Follow TechRadar on Google News and include us as a favored source to get our specialist news, evaluations, and viewpoint in your feeds.