Fake WatchGuard VPN Site Phished MSP Logins, Then Installed Real App

A fake WatchGuard VPN client download site phished an MSP administrator's credentials this month — and then, instead of dropping malware, quietly installed the genuine, validly signed WatchGuard installer pulled straight from WatchGuard's own content delivery network. Security vendor Huntress disclosed the incident on October 13, tracing the lure to a lookalike domain, watchguard-vpn[.]net, that surfaced in a Bing search for a misspelled "watchguard vpn ssl download" query. Because the only file ever delivered was the real, signed WatchGuard client, antivirus and EDR tools had nothing to flag — the theft happened entirely in a browser pop-up before any download occurred.

The case is the latest sighting of a long-running credential-harvesting operation that WatchGuard's own Secplicity research team first documented in January and that Microsoft's threat intelligence team has since attributed, in a related campaign variant, to a financially motivated actor it tracks as Storm-2561. The group has built lookalike download pages for VPN clients from WatchGuard, Cisco, Fortinet, Palo Alto Networks, SonicWall, Sophos and others, using search-engine poisoning to put the fake pages in front of IT administrators who are simply trying to download software.

What happened

According to Huntress's write-up, an administrator at a managed service provider searched Bing for "watchguard vpn ssl download" — misspelling "ssl" as "sll" — and within eight seconds clicked through to www.watchguard-vpn[.]net, a page titled "WatchGuard Firebox VPN Client." Huntress attributes the placement to SEO poisoning rather than paid search ads, based on the standard bing.com/ck/a redirect chain and the domain's organic ranking.

Clicking a download option on the page opened a browser pop-up asking the visitor to "enter your connection details" before installation could begin — three fields: server address, username and password. Huntress's analysts found the phishing logic lived in a roughly 150-line, unobfuscated popup.js file that posted the submitted JSON straight to a second domain, watchguard-ssl[.]online.

The two-submission trick

The mechanism that makes this campaign notable is what happened after that first submission. Rather than accepting the credentials and moving on, the fake site rejected them: fields cleared, and red text read "Incorrect data, please enter again to start installation." Only on the second attempt did the pop-up turn green with a message that installation had started.

Huntress's analysis concludes this was a deliberate design choice — asking twice gives the operator two credential submissions to cross-check against each other, filtering out visitors who enter junk data to test the page and increasing confidence that the harvested username and password are real and usable. It is the digital equivalent of a scammer asking you to repeat your PIN "just to make sure."

Why it evades detection

Most fake software-download scams eventually serve a trojanized installer, which is the point where antivirus engines, EDR agents and threat-intel feeds usually catch them. This campaign skips that step entirely. After the second credential submission, the site's script triggers a hidden link that downloads the real file directly from WatchGuard's own infrastructure: cdn.watchguard.com/SoftwareCenter/Files/MUVPN_SSL/12_11_5/WG-MVPN-SSL_12_11_5.exe. Huntress recomputed the installer's Authenticode signature and confirmed it matches WatchGuard Technologies' own code-signing certificate, issued through Sectigo.

In other words, the only "malicious" artifact in the entire chain is a webpage and a short JavaScript file — no payload, no dropper, nothing for a file-scanning tool to convict. The credentials are stolen before a single byte of software reaches the victim's machine. Huntress's own detections in this incident reportedly fired in 21 seconds, but that came from monitoring the suspicious domain and page behavior, not from catching a bad file.

Domains and timeline

Huntress's incident write-up and WatchGuard's earlier Secplicity research together sketch a timeline of infrastructure reuse and rotation around the same lookalike brand name:

Huntress notes it cannot confirm whether the same operator controlled the January and August registrations of the watchguard-vpn[.]net name — domain names do get recycled by unrelated parties — but the reuse of the exact same brand-spoofing pattern is consistent with a persistent, organized operation rather than a one-off.

The Storm-2561 connection

WatchGuard isn't the only vendor being spoofed this way, and the broader pattern has a name. In a March 12 post, Microsoft's threat intelligence and Defender Experts teams detailed a campaign they attribute to Storm-2561, a financially motivated actor Microsoft says has been active since May 2025 and is known for SEO-poisoning fake VPN-client download sites. Microsoft's indicator list for that campaign includes a WatchGuard lookalike domain, watchguard-vpn[.]com, alongside spoofed domains for Cisco's Secure Client and Fortinet's FortiClient, among others.

In the variant Microsoft examined, victims who searched for terms like "Pulse VPN download" were pushed to a GitHub-hosted ZIP file containing a digitally signed but malicious MSI installer that side-loaded an infostealer, captured credentials through a fake sign-in dialog, then displayed a fake installation error and redirected the victim to the real vendor's site — leaving them none the wiser. Huntress is careful to note that the October WatchGuard incident it investigated is a different, arguably simpler variant: rather than signing and delivering a fake installer, this version skips the malware step entirely and hands over the authentic file. Whether the same group operates both variants is unconfirmed, but the shared targeting of VPN-client downloads, the shared brand-impersonation technique and the overlapping domain-naming conventions point to the same underlying criminal ecosystem.

Related reading: our explainer on what a man-in-the-middle attack is and how to stop one covers a different but related family of credential-interception techniques IT teams should know.

Who's at risk

The targeting here is specific: IT administrators, MSP technicians and other corporate users searching for VPN client software — exactly the audience least likely to expect a fake download page, because they are not consumers clicking a phishing email but professionals doing routine software maintenance. A misspelled search term, an ad-blocker gap, or simply trusting a top search result is enough to land on one of these pages.

The stakes are higher than an individual's email password. VPN server addresses plus admin-level or privileged user credentials can give an attacker a direct path into a corporate network or, in the case of an MSP, into every client network that MSP manages. That "one admin, many downstream clients" blast radius is precisely why MSPs have become an attractive target for this kind of campaign over the past two years.

What to do right now

WatchGuard's own support documentation on Mobile VPN with SSL connections is the authoritative reference for how the client is meant to be deployed and configured — a useful page to bookmark instead of re-searching for the client every time a machine needs it reinstalled.

How IT teams can watch for this pattern across other vendors

Because the same actor has built lookalike infrastructure for multiple VPN brands, security teams shouldn't treat this as a WatchGuard-specific problem. WatchGuard's January Secplicity research identified lookalike or credential-harvesting domains spoofing Cisco AnyConnect, Fortinet FortiClient, Palo Alto GlobalProtect, Check Point's Remote Access client, Citrix Secure Access, F5's BIG-IP client, SonicWall NetExtender and Sophos Connect, among others — meaning any organization that lets end users self-serve VPN client downloads is a potential target, regardless of which vendor it standardizes on.

Practical steps for security teams: block or restrict software downloads to an allowlist of vendor domains at the web proxy or DNS layer; distribute VPN clients through managed software deployment (RMM, MDM, SCCM/Intune) rather than leaving staff to find the installer themselves; and treat any security pop-up that asks for credentials before a download completes as an immediate red flag, since legitimate installers do not need your VPN password to begin installing. Teams evaluating whether a traditional VPN client is even the right tool for remote access may also want to read our comparison of Tailscale versus WireGuard, both of which authenticate differently from the server-address-and-password model this campaign exploits.

More broadly, this is the same social-engineering logic that underpins other credential-phishing formats — our explainer on smishing and SMS phishing scams walks through the text-message equivalent of the same playbook: urgency, a convincing lookalike, and a request for credentials dressed up as a routine step.

What happens next

The specific lookalike domain in this incident, watchguard-vpn[.]net, was already offline by the time Huntress published its findings on October 13, and the credential-collection domain watchguard-ssl[.]online is likely to be taken down or reported in the same wave. But domain takedowns rarely end campaigns like this one — WatchGuard's own research noted the same watchguard-vpn[.]net name was active with different hosting as far back as January, and Microsoft's Storm-2561 reporting describes an actor that has been rotating infrastructure and brand targets since at least May 2025.

Expect further rotation: new lookalike domains for WatchGuard and other VPN vendors, registered under different registrars, hosted on different IP ranges, and surfaced through the same SEO-poisoning technique. Neither Huntress nor WatchGuard has published a complete list of every domain tied to the operation, and neither vendor's post states whether law enforcement has been engaged. Organizations that rely on any VPN client for remote access should treat "verify the download source" as a standing instruction for staff, not a one-time warning tied to this single incident.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage