Fake WatchGuard VPN site steals credentials, then serves the genuine signed client
Fake WatchGuard VPN site steals credentials, then serves genuine client.
Run WatchGuard?
Get an email when a reviewed story names WatchGuard, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Researchers discovered an SEO-poisoning campaign using a fake WatchGuard VPN download site (watchguard-vpn[.]net) to steal user credentials. After harvesting the credentials, the malicious site serves the legitimate, signed WatchGuard client installer from the official CDN, making it difficult for endpoint security tools to detect the compromise.
The lesson from this incident
Full lessonAttackers created a convincing counterfeit WatchGuard VPN download site and used SEO poisoning to surface it in search results, tricking users into entering their credentials before receiving the genuine, signed client binary. The delivery of a legitimate, unmodified installer is a deliberate tactic to suppress endpoint security alerts and reduce victim suspicion, making the credential theft nearly invisible. This attack exploits user trust in software signing and search engine results rather than any software vulnerability. The consequences are severe: harvested VPN credentials grant attackers direct access to corporate networks, bypassing perimeter defenses entirely.
What helps against this
How we list vendors- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
- domain — watchguard-vpn[.]net