Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client

In early October, a sophisticated phishing campaign impersonated WatchGuard VPN by hosting a fake download site at watchguard-vpn.net. The attack leveraged SEO poisoning to increase visibility in search results. Victims were prompted twice via browser pop-ups to submit credentials; the first submission was rejected to collect multiple passwords. The campaign then downloaded the legitimate, signed WatchGuard VPN installer directly from the official CDN, avoiding detection by security tools. Credentials collected at watchguard-ssl.online included server addresses, usernames, and passwords, enabling attackers to gain network access. The domain watchguard-ssl.online was previously dormant but re-registered and equipped with phishing backend functionality by September. This campaign is attributed to the adversary Storm-2561.

Successful credential theft can lead to unauthorized network access via compromised VPN accounts. The use of a genuine signed client installer reduces the likelihood of detection by endpoint security solutions, increasing the risk of compromise. The campaign's ability to collect multiple passwords per victim enhances attacker access capabilities. No direct exploitation of software vulnerabilities is involved, but the impact is significant due to credential compromise and potential lateral movement within victim networks.

No official patch or fix applies as this is a phishing campaign rather than a software vulnerability. Users should be educated to verify URLs carefully and avoid entering credentials on suspicious sites. Organizations should monitor for unusual VPN login activity and consider multi-factor authentication to reduce risk from stolen credentials. Security teams should block known phishing domains such as watchguard-vpn.net and watchguard-ssl.online. Since the campaign uses a genuine signed installer, reliance on signature-based detection alone is insufficient.