Fake WatchGuard VPN download site (Huntress, 13 Oct): SEO-poisoned lookalike harvests SSL VPN server, username and password twice, then serves the genuine signed WatchGuard installer so endpoint tools see nothing malicious; an MSP admin was caught via a Bing search
Huntress reported on 13 October 2026 (14 Oct Perth) a credential-phishing campaign built on a lookalike download site for WatchGuard Mobile VPN with SSL. In an incident it investigated in early October, an administrator at a managed service provider searched Bing for a WatchGuard SSL VPN download and opened the fake site from a normal search result, which Huntress classes as SEO poisoning rather than malvertising. Choosing any download option opened a prompt asking for VPN server, login and password; about 150 lines of JavaScript sent the values as JSON to a separate collection server, always rejected the first attempt as 'Incorrect data' to collect a second set, then started a download of the genuine, validly signed WatchGuard Mobile VPN with SSL 12.11.5 installer from WatchGuard's own CDN, so there was no malicious file for endpoint security to flag. The same lookalike domain had been reported by WatchGuard in January with no working back end; it was registered again on 22 August and paired with a new collection domain. Huntress says the main domain was offline as of 13 October and that it notified WatchGuard before publishing. Earlier waves of the same VPN-impersonation activity (including Microsoft's Storm-2561 reporting) used fake signed installers and malicious DLLs instead. This is a phishing campaign against VPN users, not a flaw in WatchGuard products.
- Product
- WatchGuard Mobile VPN with SSL users (impersonation; no WatchGuard product flaw)
- Exploited in Australia?
- unknown
- Patch to
- Download VPN clients only from the vendor's own portal or your internal software catalogue, never from a search result; bookmark the real page for admins and MSP staff. Require MFA on the SSL VPN and alert on VPN logins from new devices, ASNs or countries. If anyone entered VPN credentials on an unofficial site, reset them and review VPN session logs for the period since.
Primary: Huntress — Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client (13 Oct 2026) · Vendor: Huntress research write-up (attack flow, credential-capture logic, infrastructure notes) · Cybersecurity News — Hackers use fake WatchGuard VPN download site to steal login credentials (14 Oct 2026)