Fake WatchGuard VPN Site Steals Credentials
Huntress found a WatchGuard lookalike that phished VPN server, login, and password via SEO poisoning.
Huntress investigated an October 7 incident in which an MSP administrator reached the lookalike domain watchguard-vpn.net from Bing and was prompted for VPN server, login, and password. Unobfuscated popup.js posted the credentials as JSON to watchguard-ssl.online, rejected the first attempt, and then offered a genuine, validly signed WatchGuard installer. The domain was offline by October 13. Microsoft previously attributed related watchguard-vpn.com activity to financially motivated Storm-2561.
- An MSP admin reached watchguard-vpn.net from a Bing search on October 7.
- A popup collected VPN server, login, and password and posted them to watchguard-ssl.online.
- The script rejects the first entry and asks the victim to submit again.
- This wave served a genuine signed WatchGuard installer rather than a fake MSI.
- Microsoft previously linked related watchguard-vpn.com activity to Storm-2561.
- Vendors
- WatchGuardMicrosoft
- Threat actors
- Storm-2561
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | software.watchguard.com | and bookmark) official VPN-client download links, including software.watchguard.com , in client documentation. Indicators of Compromise (IOCs) |
| domain | watchguard-ssl.online | ... The user's typed input is wrapped in JSON and posted to watchguard-ssl[.]online , tagged to indicate whether this is the first or second |
| domain | watchguard-vpn.com | paign included two domains impersonating WatchGuard itself: watchguard-vpn[.]com and watchguard-vpn[.]net . The findings included a .NET e |
| domain | watchguard-vpn.net | s impersonating WatchGuard itself: watchguard-vpn[.]com and watchguard-vpn[.]net . The findings included a .NET executable posing as their |
| ipv4 | 158.94.209.19 | tered through Dynadot on September 14, 2026 and resolves to 158.94.209[.]19 (Omegatech LTD, AS202412, Amsterdam). The table below out |
| ipv4 | 74.208.236.39 | Secplicity recorded the same domain in January resolving to 74.208.236[.]39 ; as of October 9 it resolves to 80.249.132[.]140 on Site |
| ipv4 | 80.249.132.140 | solving to 74.208.236[.]39 ; as of October 9 it resolves to 80.249.132[.]140 on Site BV hosting (LeaseWeb Netherlands, AS60781). This |
| url | https://www.watchguard-vpn.net/ | ter ( aHR0cHM6Ly93d3cud2F0Y2hndWFyZC12cG4ubmV0Lw decodes to hxxps://www.watchguard-vpn[.]net/ ). This redirect is consistent with a standard Bing searc |
From the original article
7 min read at huntress.comA fake WatchGuard VPN download site steals SSL VPN credentials, then serves the real signed client. Learn how it works and how to spot it.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.