Fake WatchGuard VPN Site Steals Creds Then Hands You the Real Installer

Endpoint tools hate this one weird trick: do not deliver malware. Huntress just documented a WatchGuard Mobile VPN with SSL lure that farms your gateway address, username, and password in the browser, rejects the first try on purpose, then downloads the genuine, Authenticode-signed client straight from WatchGuard’s CDN. Your EDR sees a clean install. Your VPN sees a new “user” from Amsterdam hosting. Everyone is fine except you.

On October 13, 2026, Huntress published “Clean Install, Stolen Creds.” An MSP admin typo-searched Bing for “watchguard vpn sll download,” clicked watchguard-vpn[.]net eight seconds later, and walked into a lookalike “Firebox VPN Client” page. The click rode Bing’s normal bing.com/ck/a redirect. That is SEO poisoning, not a shady banner ad. WatchGuard’s Secplicity team had flagged the same domain family back in January with no backend. Microsoft later tied a related watchguard-vpn[.]com wave to Storm-2561 with signed fake MSIs and DLL sideloading. October’s twist deletes the trojan middleman.

The flow, without the marketing brochure

1. Victim lands on a fan-site-flavored clone that still somehow ranks. Disclaimer at the bottom even admits it is “not an official sales, download, or support channel.” Bold strategy.
2. Download page at /index.php offers OS flavors. Any click pops a modal: Server, Login, Password. Same three fields the real client asks for when you connect. Muscle memory does the rest.
3. popup.js (about 150 lines, not even obfuscated) POSTs JSON to watchguard-ssl[.]online with an attempt flag.
4. First submission always fails. Red text: “Incorrect data, please enter again.” Fields clear. People who mistyped get careful. People who rotate passwords try the other one. Attacker gets two bites.
5. Second submission turns the UI green and triggers a hidden download from https://cdn.watchguard.com/SoftwareCenter/Files/MUVPN_SSL/12_11_5/WG-MVPN-SSL_12_11_5.exe. Real Inno Setup installer, version 12.11.5, signed by WatchGuard Technologies via Sectigo. Huntress recomputed the Authenticode SHA-256 digest and it matched. Binary was not patched after signing.

In the specific case Huntress worked, browser history showed no CDN download, which suggests the user never finished attempt two. Managed Defender still flagged the malicious domain twenty-one seconds after load. That is the difference between “interesting telemetry” and “welcome to lateral movement.”

Infrastructure timeline (UTC)

• 2026-01-13: Secplicity reports watchguard-vpn[.]net (then 74.208.236.39) with no backend logic
• 2026-08-22: Domain re-registered (Realtime Register B.V.), later resolving to 80.249.132.140 (Site BV / LeaseWeb NL, AS60781)
• 2026-09-14: Collector watchguard-ssl[.]online registered (Dynadot), resolving to 158.94.209.19 (Omegatech LTD, AS202412, Amsterdam)
• 2026-09-17 / 22: urlscan submissions of the lure
• 2026-10-07: Victim hit in the Huntress case
• As of 2026-10-13: Huntress says the main lure domain was offline; they notified WatchGuard beforehand

VirusTotal coverage was thin when Huntress looked (seven vendors on the lure, two on the collector) because, again, there is no malware file. AbuseIPDB was quiet. Reputation systems that only grade binaries are grading the wrong exam.

IOCs worth blocking today

• Domains: watchguard-vpn.net, www.watchguard-vpn.net, watchguard-ssl.online (also watch prior lookalikes like watchguard-vpn.com from earlier waves)
• IPs: 80.249.132.140 (lure hosting), 158.94.209.19 (collector)
• Artifact: popup.js credential modal posting server, login, password, attempt
• Behavior: browser POSTs to unfamiliar “ssl/online” domains right before a WatchGuard CDN download; SSL VPN logins from hosting ASNs or brand-new geos after a “client reinstall”

What to actually do

1. If anyone typed VPN creds into a search-result download page, reset those passwords and treat the gateway as known to the attacker. Rotate shared service accounts. Review concurrent sessions.
2. Enforce MFA on SSL VPN. Password-only VPN in 2026 is a lifestyle choice, and not a good one.
3. Block the domains and IPs above at DNS and egress. Alert on new VPN source ASNs.
4. Publish bookmarkable official download links (software.watchguard.com and friends) in your MSP runbooks so techs stop Bing-improvising.
5. Hunt browser history and proxy logs for the lure host and for JSON posts that look like connection-detail exfil. Do not wait for a “malware” alert that will never come.

How this fits the wider VPN SEO poison wave

January’s Secplicity work already spanned WatchGuard, F5, Fortinet, SonicWall, and Sophos lookalikes. Microsoft’s Storm-2561 writeup walked through Pulse/Fortinet/Ivanti brand abuse, GitHub-hosted ZIPs, and signed MSI sideloading. WithSecure has described HTA-based WatchGuard stealer lures and overlay phishing forms that harvest credentials then fetch the real installer as a decoy. Huntress’s October case is the polished end state: no malicious PE, no revoked cert drama, just JavaScript and trust in search rankings.

ThreatFox and similar feeds are loud right now with stealer C2 (Vidar URLs, Remcos and Cobalt Strike listeners, ClearFake domains such as amanahtop.us.com). Those are different clusters. Do not mash them into this story. The WatchGuard lure is credential theft without a payload. Your detections have to care about browser behavior and VPN auth anomalies, not just malware family tags.

Questions to ask your SOC tooling vendor (bring popcorn)

• Do you alert when a corporate browser hits a newly registered lookalike of a VPN vendor and then POSTs JSON with password fields?
• Do you correlate “clean” vendor CDN downloads with preceding visits to non-vendor domains that impersonate that vendor?
• Can you baseline SSL VPN source ASNs per account, or do you only alert on “impossible travel” after the attacker already changed the MFA phone number?

If the answers are marketing slides, you already know the outcome of the next tabletop.

User education that does not insult adults

“Do not click bad links” failed as a strategy sometime during the Bush administration. Better prompts for helpdesk and MSP techs:

• Downloads for security products come from bookmarks or ticketing macros, never from the first search hit after a typo.
• Any page that asks for VPN server, username, and password in a browser before an installer runs is a phishing form wearing a product shirt.
• “Incorrect password, try again” on a download site is not a login UX flourish. It is a second harvest.
• A clean VirusTotal score on a WatchGuard-signed binary proves WatchGuard signed a binary. It does not prove the website that handed it to you was WatchGuard.

Sample detection logic (pseudocode, adapt to your stack)

WHEN browser_history.host LOOKS_LIKE vendor_vpn_lookalike
 AND http_post.body CONTAINS fields (server, login, password)
 AND within 10 minutes download.host IN (cdn.watchguard.com, other vendor CDNs)
THEN alert "VPN credential harvest with clean decoy installer"
SEVERITY high
NOTIFY identity + network

Pair that with VPN auth alerts for new ASN per user. You will still miss disciplined attackers. You will catch the MSP admin who typed the password twice because the red text said so.

Sloth take

We spent a decade training SOC tools to hate unsigned droppers, so crooks stopped bringing droppers. They bring a form, a lie, and the vendor’s own CDN. Storm-2561 and friends already proved signed fake clients work. Now the fake client is optional. Your detection story that starts with “hash the installer” ends with a shrug. Detect the phishing domain, the collector POST, and the weird VPN login. Or keep waiting for a Trojan.Win32 that politely introduces itself.

Need a grown-up to look at your edge stack? Book a slot with Dark Edge Consulting. We do the boring, careful work so you can go back to ignoring your inbox.

Sources

• Huntress, Clean Install, Stolen Creds (2026-10-13): huntress.com
• WatchGuard Secplicity January 2026 research on multi-vendor VPN lookalike download sites
• Microsoft Security Blog, Storm-2561 SEO poisoning for fake VPN clients (2026-03-12)
• AlienVault OTX pulse mirroring the Huntress findings (2026-10-13)