A lookalike WatchGuard download site is harvesting SSL VPN logins and then handing victims the genuine, digitally signed WatchGuard installer, so there is no malware for security tools to catch and nothing seems wrong to the user. James Northey of Huntress described the campaign in a new analysis after the company's SOC investigated an incident on October 7.
VPN credentials are a direct line into a corporate network. A username and password, paired with the server address this site also asks for, gives an attacker everything needed to try logging in from outside.
One typo, one search result
The incident began with an administrator at a managed service provider searching Bing for "watchguard vpn sll download". Eight seconds later they clicked through a standard Bing result to www.watchguard-vpn[.]net, a page titled "WatchGuard Firebox VPN Client". Huntress classifies the lure as SEO poisoning rather than a paid ad, in line with earlier reporting from WatchGuard's Secplicity team and Microsoft. The fake site even carries a small footer calling itself an independent "fan site".
The domain is not new. Secplicity flagged watchguard-vpn[.]net in January 2026 as part of a wider campaign spoofing VPN clients from WatchGuard, F5, Fortinet, SonicWall and Sophos, and Microsoft later tied a sister domain, watchguard-vpn[.]com, to a financially motivated actor it tracks as Storm-2561. Huntress notes the .net domain was registered again on August 22, 2026, and says the available evidence does not establish whether the same operators controlled both registrations.
Wrong password, by design
Clicking any download button opens a pop-up asking for Server, Login and Password, the same three fields the real Mobile VPN with SSL client requests. About 150 lines of plain JavaScript in a file called popup.js wrap the answers in JSON and post them to a separate collector, watchguard-ssl[.]online. Then the script deliberately rejects the first attempt with a red "Incorrect data, please enter again" message. A user who mistyped retypes carefully, and one unsure which password applies tries another, so the attacker gets a second set of credentials to test.
After the second submission the pop-up turns green and quietly starts a download straight from WatchGuard's own CDN: the Mobile VPN with SSL client, version 12.11.5, signed by WatchGuard Technologies. Huntress recomputed the Authenticode digest and confirmed the file is unmodified. Earlier iterations described by Microsoft served a fake signed MSI that sideloaded malicious DLLs; this one drops the malware altogether. In the case Huntress handled, browser history showed no download, suggesting the user did not finish both rounds, though they may have entered credentials in the first. Huntress flagged the activity 21 seconds after the page loaded.
Detection elsewhere was thin. As of October 8 only seven VirusTotal engines flagged the lure domain and two flagged the collector. Huntress says it notified WatchGuard before publishing, and the lure domain was offline as of October 13.
Reset passwords, enforce MFA, block these hosts
Anyone who typed credentials into this or a similar site should reset every affected password immediately and treat the associated VPN endpoint as known to the attacker. Huntress also advises:
- Enforcing MFA on SSL VPN logins on top of username and password
- Watching for VPN logins from hosting providers, unfamiliar ASNs or countries the account has never used
- Blocking watchguard-vpn[.]net (80[.]249[.]132[.]140) and watchguard-ssl[.]online (158[.]94[.]209[.]19)
- Publishing and bookmarking official download links, such as software.watchguard.com, in client documentation
WatchGuard drew attention in August too, when critical flaws hit its Windows agent, and search poisoning has recently carried other fake installers, such as the bogus KakaoTalk downloads. The lesson from this campaign is uncomfortable: when the payload is the real thing, the only evidence left is a password typed into the wrong page.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.