Cybercriminals set up a counterfeit WatchGuard support website designed to harvest VPN credentials before supplying the legitimate client software. The operation was uncovered by Huntress researchers while investigating a security incident that occurred on October 7 at a managed service provider.
Victims arrived at the fake site through ordinary Bing search results for the query watchguard vpn sll download. The malicious domain used was watchguard-vpn.net. Researchers attributed the traffic to SEO poisoning rather than paid malicious advertisements.
The fraudulent page closely replicated the official WatchGuard support layout, complete with frequently asked questions and a prominent download button. Clicking the button opened a form requesting three fields: Server, Login, and Password.
The attackers employed a simple but effective social-engineering trick. The first submission was always rejected with the message Incorrect data, encouraging the victim to re-enter the information. Only on the second attempt did a hidden link deliver the genuine installer WG-MVPN-SSL_12_11_5.exe, which carried a valid digital signature.
Credential collection was handled by an approximately 150-line JavaScript script that transmitted the data in JSON format via HTTP POST to a second domain. Network errors during this step produced only a browser console warning, leaving the victim unaware of any issue.
As a result, the user received and installed the correct VPN client with no visible signs of compromise, while the attackers obtained the server address and credentials. No additional malware was delivered. The phishing site, whose footer described it as an independent fan site, went offline on October 13.
Security recommendations include changing any exposed passwords, treating disclosed server addresses as known to attackers, enforcing multi-factor authentication, and reviewing VPN login logs for anomalies. Users should download software exclusively from the official portal using bookmarks rather than search engine results.
