A fraudulent website that simulated the WatchGuard download page was used to steal corporate network access credentials without raising user suspicion. Researchers from the security company Huntress identified this campaign, which aimed to collect VPN server addresses, usernames, and passwords before providing the authentic program for installation.
The investigation began after detecting suspicious activity related to an administrator working for a managed service provider. According to Huntress, this user searched for a WatchGuard VPN download on Bing and accessed a deceptive page that replicated the appearance of the company's official site.
This address featured a supposed download page for Mobile VPN with SSL. To proceed with the installation, the visitor was required to fill out a form containing the server address, username, and password—data also required by the legitimate client.
However, upon submitting the data, the user sent it to a different domain controlled by those running the operation. The obtained information could be used to attempt access to the organization's network.
The malicious system had a mechanism that rejected the first form submission and erased the filled fields, forcing the victim to enter the credentials again. This allowed the criminals to obtain multiple attempts at capturing the passwords.
Huntress reported that the domain used to offer the download was registered on August 22, 2026, while the domain dedicated to collecting credentials appeared on September 14 of the same year. WatchGuard had already notified about a similar address in January, but at that time, researchers had not found a functional method to guide visitors through the fraudulent process.
After collecting the information, the site initiated the software download directly from WatchGuard's official content distribution network, instead of providing a fake installer. The file corresponded to version 12.11.5 of Mobile VPN with SSL and possessed a valid digital signature from WatchGuard Technologies, dated November 4, 2025.
Huntress confirmed that the installer had not been altered after signing. Thus, researchers found no evidence of modifications to the genuine executable.
This tactic differs from attacks that distribute tampered installers or malicious libraries, files that can be detected by endpoint protection tools. In this scenario, because the credential theft occurred directly through the browser, downloading the original program helped reduce suspicion.
The investigation did not record any downloads on the official server during the analyzed incident, suggesting that the user may not have completed both attempts to submit the credentials. The security operations team was alerted 21 seconds after the site loaded, allowing them to provide response guidance before researchers observed an additional increase in activity.
Huntress communicated that the main fraudulent domain was inoperative on October 13. However, this situation does not confirm that the entire infrastructure linked to the operation has been deactivated.
For organizations that may have been affected, it is recommended to reset compromised passwords, activate multi-factor authentication, and check for any suspicious VPN access. It is also advisable to instruct employees to obtain software only through official vendor pages.
The case illustrates how a download page can be used to capture confidential data even when the file offered to the visitor is legitimate. In this type of attack, the compromise occurs during the form filling, before the software installation.