[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJTJhDgPsiWf0ocOUml1JIJw2ZN4KC4VVhakJXYogGlU":3},{"article":4,"iocs":46,"watch_terms":51,"solutions":52,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":30},"819d0c51-55cf-4283-8393-f9edf1569931","Fake WatchGuard VPN site steals credentials, then serves the genuine signed client","fake-watchguard-vpn-site-steals-credentials-then-serves-the-genuine-signed-clien-791bd1","Huntress researchers have uncovered an SEO-poisoning campaign that harvests SSL VPN credentials through a lookalike WatchGuard download page, then hands victims the real, validly signed installer from WatchGuard’s own CDN, leaving endpoint tools with nothing to detect. The activity, detailed by the Huntress SOC on 13 October, centres on watchguard-vpn[.]net, a lookalike domain posing as […] The post Fake WatchGuard VPN site steals credentials, then serves the genuine signed client appeared first on IT Security Guru.","Researchers discovered an SEO-poisoning campaign using a fake WatchGuard VPN download site (watchguard-vpn[.]net) to steal user credentials. After harvesting the credentials, the malicious site serves the legitimate, signed WatchGuard client installer from the official CDN, making it difficult for endpoint security tools to detect the compromise.","Fake WatchGuard VPN site steals credentials, then serves genuine client.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F10\u002F14\u002Ffake-watchguard-vpn-site-steals-credentials-then-serves-the-genuine-signed-client\u002F?utm_source=rss&utm_medium=rss&utm_campaign=fake-watchguard-vpn-site-steals-credentials-then-serves-the-genuine-signed-client",null,"2026-10-14T10:50:35+00:00","2026-10-14T18:00:06.387605+00:00",7,[17,20,23],{"name":18,"type":19},"SSL VPN","product",{"name":21,"type":22},"WatchGuard","vendor",{"name":24,"type":25},"CDN","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":12,"name":28,"slug":29},"Malware","malware",[31,36,41],{"category":32},{"id":33,"icon":12,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":12,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":43,"icon":12,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":48,"value":49,"context":50},"domain","watchguard-vpn[.]net","Malicious domain impersonating WatchGuard VPN",[21,18],{"controls":53,"vendors":133},[54,81,107],{"slug":55,"name":56,"problem":57,"products":58},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[59,67,73],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":68,"product_name":69,"url":71,"description":72},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"slug":82,"name":83,"problem":84,"products":85},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[86,91,99],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":87,"product_name":88,"url":89,"description":90},"cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"slug":108,"name":109,"problem":110,"products":111},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[112,120,126],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":121,"product_name":122,"url":124,"description":125},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":127,"product_name":130,"url":131,"description":132},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":152},"seo-poisoned-fake-vpn-site-harvests-credentials-before-serving-legitimate-installer","SEO-Poisoned Fake VPN Site Harvests Credentials Before Serving Legitimate Installer","Attackers created a convincing counterfeit WatchGuard VPN download site and used SEO poisoning to surface it in search results, tricking users into entering their credentials before receiving the genuine, signed client binary. The delivery of a legitimate, unmodified installer is a deliberate tactic to suppress endpoint security alerts and reduce victim suspicion, making the credential theft nearly invisible. This attack exploits user trust in software signing and search engine results rather than any software vulnerability. The consequences are severe: harvested VPN credentials grant attackers direct access to corporate networks, bypassing perimeter defenses entirely.",[139,140,141,142,143,144,145,146,147,148,149,150,151],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","CIS Control 9: Email and Web Browser Protections","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 IA-5: Authenticator Management (MFA)","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST CSF PR.AT-1: Awareness and Training","NIST CSF DE.CM-7: Monitoring for Unauthorized Activity","GDPR Article 32: Security of Processing (credential protection as personal data safeguard)","ITIL: Service Configuration Management (approved software sources)",{}]