Key points
- The attack uses SEO poisoning to promote a fake domain that mimics the official WatchGuard download page.
- Victims enter their server address, username, and password into a browser prompt before the real installer is served.
- Huntress confirmed the primary domain was offline as of October 13, with no software patch required for this vector.
Security teams should note that this incident targets WatchGuard Mobile VPN users through a deceptive download process rather than a software flaw. No patch or update exists because the issue involves a deceptive website, not a vulnerability in the WatchGuard code. The primary domain observed, watchguard-vpn[.]net, was offline by October 13, according to Huntress.
In plain English
Users searching for VPN clients may encounter a fake website designed to look exactly like the official vendor page. When users click the download button, they are prompted to enter their VPN server address, username, and password. This step happens before any file is downloaded. The site captures these credentials and sends them to an attacker-controlled server.
The background
Huntress researchers identified this activity after an administrator at a managed service provider searched Bing for a WatchGuard client in October 2026. The user clicked a result that redirected to the spoofed domain within eight seconds. This method is classified as SEO poisoning, where attackers manipulate search rankings to place malicious sites at the top. Previous iterations of this campaign, reported by Microsoft and WatchGuard's Secplicity team in early 2026, used fake executables. This latest version serves the genuine, signed installer from cdn.watchguard.com after stealing the login data.
What changes now
The campaign has evolved to remove the malicious executable from the download chain entirely. By delivering the legitimate WatchGuard Mobile VPN with SSL 12.11.5 installer, the attackers ensure the victim sees no errors and installs real software. This makes detection harder because the final file is validly signed. The credential theft occurs solely in the browser via JavaScript.
Who needs to act first
Teams should prioritize verifying how their staff obtains software downloads. Check whether administrators are using curated internal portals or bookmarks instead of public search engines. Review web proxy logs for visits to domains that closely resemble vendor names but use different top-level domains. Ensure that multi-factor authentication is enforced for all VPN access, as stolen passwords alone should not grant entry. Train users to recognize that legitimate vendors rarely ask for credentials before downloading a client installer.
What to do and how to stay safe: WatchGuard
- Verify the URL of any download page carefully, ensuring it matches the exact official domain of the vendor.
- Enforce multi-factor authentication for all remote access connections to mitigate the impact of stolen passwords.
- Monitor web traffic logs for requests to domains that are slight variations of known vendor names.
- Educate staff that legitimate software installers do not require login credentials to be entered in a browser prompt before download.
Step-by-step guide: DDoS Protection: 8 FAQs on Mitigation and Architecture
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does WatchGuard have a software patch for this credential theft?
No, there is no software patch because the attack exploits user trust in a fake website, not a vulnerability in the WatchGuard software itself.
Which domain was used in the Huntress investigation?
The investigation focused on watchguard-vpn[.]net, which was observed to be offline as of October 13.
Did the fake site deliver a malicious executable?
No, the site delivered the genuine, digitally signed WatchGuard Mobile VPN with SSL 12.11.5 installer after harvesting credentials.
