Fake VPN credential scam hides theft with real signed installer

A counterfeit VPN download site quietly captured administrator credentials while pushing a genuine VPN client. Investigators traced the activity to a lookalike domain that harvested login details before the real software was installed. The stolen credentials were sent to a separate domain controlled by the attackers, increasing the chance of later access to the organization’s network.

The red flag appeared when an administrator at a managed service provider was flagged for unusual activity after attempting a download, prompting researchers to investigate. The fake page, watchguard-vpn[.]net, asked for the VPN server address, a username, and a password. It looked convincing enough to resemble a standard installation because the fields matched what the real installer would request.

Once submitted, the credentials went to watchguard-ssl[.]online, a second domain controlled by the criminals. The scheme resembled a two-step trap: the site collects credentials, then clears the fields and prompts for a second submission, boosting the odds that attackers capture repeated attempts and password retries.

Crucially, the process then began the legitimate download from WatchGuard’s content delivery network. The installer was a real Mobile VPN with SSL client, version 12.11.5, with a valid WatchGuard signature and a timestamp of November 4, 2025. The signing made the package look legitimate, helping victims overlook the credential theft until investigators traced the flow.

Security researchers noted that there’s no record of the official server downloading during the incident, suggesting some victims may have only submitted credentials once or didn’t finish the full flow. The fraudulent domain went offline by mid-October, but experts caution attackers could still be active elsewhere.

For everyday users, the message is simple: a signed installer alone isn’t a red flag. It’s the credentials that matter. If criminals obtain admin logins, they can breach corporate networks and move across systems even if the software itself seems legitimate.

Immediate steps: reset compromised passwords, enable multifactor authentication where possible, and download VPN clients only from official vendor pages. If you manage multiple devices or run security tools, look for unusual VPN sign-ins and require MFA for VPN access, especially for admins.

In broader terms, this incident highlights how attackers mix social engineering with trusted software. Firms should enforce strict download controls, monitor credential submissions that resemble official services, and educate users to spot lookalike domains during installs.