Summary
- A lookalike site captured VPN server, login and password entries through a browser prompt.
- The site deliberately rejected the first submission and then served the genuine WatchGuard installer.
- Huntress says its observed administrator may not have completed both steps; no successful network breach is established.
A fake download site impersonating WatchGuard collected remote-access credentials from visitors before offering an authentic, digitally signed copy of the company's VPN client, according to an investigation by Huntress. The technique removes the malicious installer that endpoint protection products might otherwise detect while preserving the appearance of a normal software installation.
Huntress began investigating after an administrator at a managed service provider searched Bing on 7 October for a WatchGuard VPN download, misspelling part of the query. Eight seconds later, the browser reached a lookalike site through a standard search-results redirect. The researchers classify the route as search-engine optimisation poisoning rather than a confirmed paid-advertising campaign.
The imitation site presented itself as a WatchGuard support and download page. When visitors selected a download option, a browser prompt asked for the VPN server address, username and password. Those values are normal inputs for configuring a VPN connection, helping the request appear plausible despite being delivered by an unauthorised website.
Researchers found that the page submitted credential data to a separate collection service. Its script then displayed an error for the first attempted login and asked the visitor to enter details again. This step could collect a second credential set or persuade users to correct an apparently mistyped password. Only after that process was the genuine client supplied from WatchGuard's content delivery network.
The downloaded installer was not a trojanised copy in the researchers' tests. Huntress verified that the file had a valid WatchGuard Authenticode signature and matched the signed content. That choice means a successful download would give users the software they wanted, while the credential theft had already taken place in the browser. It also reduces the usefulness of file-scanning alerts that rely on identifying a modified executable.
The incident's observed outcome needs qualification. Huntress found no browser-history evidence that the investigated administrator completed the genuine download, suggesting that the user did not finish both credential submissions. The research does not establish that attackers then authenticated to the organisation's VPN or compromised its network. Huntress says its monitoring alerted 21 seconds after the malicious page loaded, allowing the organisation to act before escalation.
The campaign shares characteristics with earlier impersonation of several remote-access vendors, including Fortinet, SonicWall, Sophos and F5. The particular October mechanism differs from older reports because the attacker no longer needs to supply a counterfeit executable. Huntress says the same lookalike WatchGuard domain had previously been reported, but evidence does not establish that identical operators controlled it across both periods.
Network infrastructure used for the lure and credential collection included hosting in the Netherlands. That connection creates a European investigative and infrastructure dimension, but it is not evidence of a European victim or proof that the campaign specifically targeted organisations in Britain or the EU. Huntress had alerted WatchGuard, and the main impersonating site was offline by 13 October.
The collected VPN server address adds a dimension absent from ordinary password-only phishing. With a server value, username and password, an operator could attempt access to the specific remote gateway rather than needing to discover an organisation's endpoint first. Whether that attempt succeeds depends on factors including password validity, multifactor authentication and access restrictions, none of which can be inferred from the existence of the phishing form alone. The attack also exploits a routine software-acquisition workflow rather than an unsolicited message: the user initiated a search and was led to a fraudulent destination. That makes the provenance of the download page as important as the digital signature of the file eventually offered.
The incident illustrates a risk in acquisition and installation workflows: the expected application can be genuine while the website gathering credentials is malicious. The observed evidence supports a confirmed phishing mechanism and a rapid detection, not a claim of completed compromise.
