A WatchGuard VPN impersonation attack that steals connection credentials in the browser before delivering the vendor’s genuine, digitally signed installer.
The campaign removes the malicious executable from the download chain, leaving victims with legitimate software. At the same time, attackers collect information needed to attempt unauthorized VPN access.
The lure, watchguard-vpn[.]net, impersonated a WatchGuard Mobile VPN with an SSL download portal. Its browser prompt requested the VPN server address, username, and password.
According to the supplied Huntress investigation, the domain was offline as of October 13, following an incident detected on October 7.
The navigation passed through Bing’s standard search-result redirect. Combined with the site’s search placement, this supports an SEO-poisoning lure rather than evidence of a paid malicious advertisement.
Download buttons on watchguard-vpn[.]net/index.php opened a prompt requesting “Server,” “Login,” and “Password.”
These fields mirrored legitimate VPN connection requirements, making the request plausible while supplying attackers with both authentication details and the gateway to target.
The harvesting logic resided in popup.js, approximately 150 lines of unobfuscated JavaScript. It packaged submitted values into JSON and sent them through an HTTP POST to watchguard-ssl[.]online, labeling submissions “first” or “second.”
Huntress Researchers observed that, the incident began when an administrator at a managed service provider searched Bing for “watchguard vpn sll download.”
Eight seconds later, the administrator visited the impersonation site, titled “WatchGuard Firebox VPN Client.”
The first submission was deliberately rejected with “Incorrect data, please enter again to start installation.” The script cleared all three fields, encouraging another attempt.
This could capture corrected credentials or an alternative password, although that intent remains an analytical assessment.
After the second submission, the prompt displayed “VPN client installation has started.” JavaScript then triggered a download of WG-MVPN-SSL_12_11_5.exe directly from cdn.watchguard.com.
The fetch is wrapped in a try/catch statement that only logs a console warning on failure, so even if the collector is down, the user sees nothing unusual.
Huntress identified the file as WatchGuard’s Mobile VPN with SSL 12.11.5 Inno Setup installer.
Its Authenticode signature named WatchGuard Technologies, Inc., with Sectigo Public Code Signing CA R36 as issuer and a November 4, 2025 countersignature timestamp.
The recomputed Authenticode SHA-256 digest matched the signed digest, indicating the executable had not been modified after signing.
The installer was therefore not the malicious component: credential theft occurred beforehand, inside the webpage.
In the investigated incident, browser history showed no corresponding CDN download. Because downloading required the second submission, this suggested the administrator had not completed both rounds; first-round credential exposure remained possible.
Huntress reported detecting suspicious activity 21 seconds after the page loaded.
WatchGuard’s January research previously identified watchguard-vpn[.]net, then without working download redirection.
Its broader investigation also documented browser-based harvesting followed by legitimate Fortinet and SonicWall downloads, showing this technique extends beyond WatchGuard impersonation.
Microsoft’s March analysis attributed a related fake-VPN campaign to Storm-2561. That operation used signed malicious installers, DLL sideloading, and subsequent redirection to genuine software.
The October evidence does not independently establish Storm-2561 attribution.
The lure domain was registered again on August 22, while its collector was registered September 14. Reported addresses were 80.249.132[.]140 and 158.94.209[.]19, respectively; continuity of ownership remains unproven.
Defenders should prioritize verified vendor downloads, browser and network protection, and VPN multifactor authentication rather than treating a valid installer signature as proof that the preceding download journey was safe.
Microsoft recommends these protections against related credential-theft campaigns.
| Item | Description |
|---|---|
watchguard-vpn[.]net | Lookalike WatchGuard VPN download page hosting the credential modal (registered 2026-08-22) |
80.249.132[.]140 | Lure hosting, Site BV / LeaseWeb Netherlands (AS60781) |
watchguard-ssl[.]online | Credential collection endpoint receiving JSON POSTs (registered 2026-09-14) |
158.94.209[.]19 | Collector hosting, Omegatech LTD (AS202412), Amsterdam |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…