Fake VPN page stole credentials before serving genuine software

A fake WatchGuard VPN download page was used to harvest corporate VPN credentials while delivering the genuine signed installer, according to reporting by TechRadar and an investigation from Huntress. ¹²

The campaign centred on the lookalike domain watchguard-vpn[.]net. Visitors searching for a WatchGuard VPN download were shown a page that asked for a VPN server address, username and password. The details were sent to a separate domain, watchguard-ssl[.]online, before the visitor was prompted to submit them again.

That double-entry trick matters because it gives an attacker more than one chance to capture a working credential set. Huntress said the fraudulent page then delivered Mobile VPN with SSL client version 12.11.5 from WatchGuard's genuine content delivery network. The installer retained WatchGuard's valid digital signature and had not been altered, which made the download look routine and reduced the chance that endpoint security tools would flag it. ²

The use of authentic software is the campaign's most deceptive feature. A victim can finish installing the expected VPN client while the important theft has already happened in the browser. Huntress said its investigation began after suspicious activity involving an administrator at a managed service provider, and it found that the deceptive domain had been registered in August 2026 while the credential-collection domain appeared in September.

TechRadar reported that WatchGuard had previously identified the lookalike address in January, although investigators at that point found no working credential-stealing mechanism. Huntress later found the active collection flow and said the main deceptive domain was offline by October 13. That does not prove that related infrastructure has disappeared, however, so organisations should treat similar domains and unexpected VPN prompts with caution. ¹²

What organisations should do

Anyone who entered VPN details into the fake page should reset the affected passwords, enable multifactor authentication where possible and review VPN sign-ins for unusual locations or times. Security teams should also check whether the credentials were reused elsewhere, investigate the endpoint that visited the page and direct staff to vendor bookmarks or known official download portals rather than search adverts or unfamiliar domains.

The incident is a useful reminder that a valid installer is not proof that the download journey was safe. Browser forms, redirects and domain names can be the real point of compromise, even when the software that arrives at the end is genuine.

Our opinion

This is exactly the kind of phishing campaign that can slip through a sensible security checklist because it avoids the usual visual cues. There is no obviously fake application to quarantine and no tampered installer to detect. The practical lesson is less about distrusting signed software than about separating software authenticity from download-path authenticity: both need checking before credentials are entered.

The safest editorial takeaway is straightforward: use the vendor's known domain, do not trust a search result merely because it looks official, and treat any request to enter VPN credentials into a browser page as a moment for verification rather than an ordinary installation step. The accompanying image is an abstract Pexels photograph of a laptop displaying code, not a depiction of the WatchGuard campaign. ³