Fake VPN credential scam hides theft with real signed installer

The fake site asked for exactly what a real VPN setup needs, then sent it to the attackers. Researchers at security company Huntress traced the activity after spotting suspicious behavior from an administrator who worked for a managed service provider, a firm that runs IT systems for other businesses.

The administrator had searched Bing for a WatchGuard VPN download and landed on watchguard-vpn[.]net, a site dressed up to look like the vendor’s official download area. It offered the Mobile VPN with SSL client and showed a short form: VPN server address, username and password.

Nothing about that looked odd. The real client asks for the same three things when you first connect, so filling them in felt like part of a normal setup. Behind the scenes, though, the form sent everything to a second domain, watchguard-ssl[.]online, where the attackers stored it.

The first attempt failed on purpose. A script on the page refused the initial submission and wiped the fields, nudging the victim to type the details again.

Most people assume a typo and try once more. That second entry gives the attackers another copy, and possibly a different password if the user was unsure which one to use. Only after the second submission did the page move on to the download.

The timeline shows planning. Huntress says the download domain was registered on August 22, 2026, and the domain that collected the logins on September 14. WatchGuard itself had flagged the lookalike address back in January, but at that point researchers found no working setup steering visitors through a fake download.

Here is the clever part. After the second submission, the site started a download from WatchGuard’s official content delivery network, the servers the company uses to hand out its files.

The file was Mobile VPN with SSL version 12.11.5. It carried a valid WatchGuard Technologies digital signature, timestamped November 4, 2025, and Huntress confirmed it had not been altered since it was signed. A digital signature is a kind of tamper seal that proves who made a file, so security tools treat it as trusted.

Many malware campaigns slip in a doctored installer or a poisoned add-on file, and endpoint security products can sometimes spot those by inspecting the file. This one skipped all that. The theft happened in the web browser, before any download began, and the install that followed worked normally. The victim had little reason to suspect a problem.

In the case Huntress looked into, its tools flagged the activity 21 seconds after the fake page loaded, and the security team sent cleanup advice before any further attack was seen. There was no record of the official file actually being downloaded, which suggests the administrator may not have finished both form submissions.

The danger here is the login, not the laptop. A signed, working app on your machine does not prove the place you got it from was honest, and the stolen details work no matter how clean your computer is.

Administrators are the prize because their accounts usually open more doors. With a valid admin VPN login, an attacker can try to enter the company network directly and move around from there. That is why the target in this case, a managed service provider, matters: one provider can hold access to many client businesses.

For ordinary staff, the lesson is simpler. If a download page asks for your VPN server address and password before you even have the app, treat that as a warning sign. In this scam, that form was the theft. And always get work software from the link your IT team gives you or from the vendor’s official site.

Act as if the password is already in the wrong hands. Huntress and other security researchers recommend a short list of steps for affected organizations:

• Reset any password that was typed into the fake page, and treat a wider reset of VPN accounts as a sensible precaution.
• Turn on multifactor authentication for VPN access, so a stolen password alone is not enough to get in.
• Check VPN logs for unusual sign-ins, such as new locations or odd hours.
• Point employees to official download pages only, and remind them that search results can lead to lookalike sites.

Huntress says the main fake domain was offline by October 13. That does not mean the people behind it are gone, and it says nothing about whether related sites are still running elsewhere.