Fake WatchGuard VPN site stole admin credentials, Huntress finds
Huntress says a lookalike download page harvested VPN logins while serving the genuine, digitally signed Mobile VPN with SSL client.
Huntress has reported that a lookalike WatchGuard download site, watchguard-vpn[.]net, collected VPN server addresses, usernames and passwords from visitors while handing them the genuine WatchGuard Mobile VPN with SSL client. The security firm detailed the campaign in an analysis credited to author Efosa.
According to the findings, credentials submitted on the fake site were routed to a separate domain, watchguard-ssl[.]online. The malicious script rejected the first form submission and cleared the fields, pushing victims to enter their details a second time.
The installer itself was the Mobile VPN with SSL client version 12.11.5, carrying a valid WatchGuard Technologies digital signature and a timestamp of November 4, 2025. Huntress investigators found no evidence that the legitimate installer had been modified.
The operator registered the download domain on August 22, 2026, and the credential collection domain on September 14. Detection occurred 21 seconds After the malicious website loaded, and the main deceptive domain was offline by October 13.
Earlier report
In January, WatchGuard had previously reported the lookalike address, though researchers then found no working mechanism for the fraudulent download process.
Quick answers
What did the fake WatchGuard site collect?
It collected VPN server addresses, usernames and passwords, sending the credentials to watchguard-ssl[.]online.
Was the downloaded installer tampered with?
No. Huntress found no evidence that the legitimate installer, version 12.11.5 with a valid WatchGuard Technologies signature, had been modified.
Is the fake domain still online?
The main deceptive domain was offline by October 13.