Full Report
A fake WatchGuard VPN download site steals SSL VPN credentials, then serves the real signed client. Learn how it works and how to spot it.
Analysis Summary
# Tool/Technique: Fake WatchGuard VPN Credential Phishing
## Overview
This is a sophisticated social engineering and credential harvesting campaign that utilizes a lookalike download site (`watchguard-vpn[.]net`) to impersonate official WatchGuard VPN software. The primary purpose is to steal SSL VPN credentials (server address, username, and password) from users seeking legitimate remote access tools.
## Technical Details
- **Type**: Phishing / Credential Harvester
- **Platform**: Web-based (cross-platform impact), targeting Windows users for the final payload.
- **Capabilities**: Browser-based credential interception, double-prompt logic (to ensure credential accuracy), and redirection to legitimate binaries.
- **First Seen**: Initial campaign variants seen January 2026; recent evolution observed August/September 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566.002 - Phishing: Spearphishing Link]**
- **[TA0006 - Credential Access]**
- **[T1539 - Steal Web Session Cookie / T1557 - Adversary-in-the-Middle]** (Logic applied via malicious web forms)
- **[TA0007 - Discovery]**
- **[T1589.001 - Gather Victim Identity Information: Credentials]**
- **[TA0005 - Defense Evasion]**
- **[T1036 - Masquerading]** (Using legitimate CDNs and signed binaries to mask malicious activity)
## Functionality
### Core Capabilities
- **Credential Harvesting**: Uses browser pop-up prompts to intercept the VPN server URL, username, and password.
- **Verification Logic**: The site deliberately rejects the first set of credentials as "incorrect." This forces the user to re-enter them, ensuring the attacker receives accurate data and potentially capturing multiple password variations.
- **Legitimate Payload Delivery**: Upon successful harvesting, the site redirects the user to the genuine, signed WatchGuard installer hosted on WatchGuard's official CDN.
### Advanced Features
- **Security Evasion**: By serving a legitimate, signed executable after the theft, the attack leaves no malicious file footprint on the endpoint, bypassing traditional Antivirus (AV) and Endpoint Detection and Response (EDR) file scanning.
- **SEO/AI Poisoning**: The domains were previously reported as being recommended by AI chatbots (like Bing Copilot) when users queried for VPN download links.
## Indicators of Compromise
- **File Hashes**: *N/A - The final delivered file is the legitimate WatchGuard signed binary.*
- **File Names**: `WatchGuard Mobile VPN with SSL Installer.exe` (Legitimate name used for bait).
- **Network Indicators**:
- `watchguard-vpn[.]net` (Phishing Landing Page)
- `watchguard-vpn[.]com` (Historical Landing Page)
- `watchguard-ssl[.]online` (Backend Credential Collection Domain)
- **Behavioral Indicators**: Users visiting non-WatchGuard domains to download corporate software; unexpected browser credential prompts appearing before a file download.
## Associated Threat Actors
- Unknown (The campaign shows signs of professional organization, targeting multiple VPN vendors including F5, Fortinet, SonicWall, and Sophos).
## Detection Methods
- **Signature-based detection**: Monitor for and block the specific phishing domains listed in the IOCs.
- **Behavioral detection**: Identify DNS queries to lookalike domains (e.g., domains containing "watchguard" but not owned by the official entity).
- **Web Filtering**: Utilize URL filtering to block newly registered domains (NRDs) like `watchguard-ssl[.]online`.
## Mitigation Strategies
- **User Training**: Educate users to download software only from official vendor websites (e.g., `watchguard.com`) or internal company portals.
- **Multi-Factor Authentication (MFA)**: Implementing MFA for SSL VPN access renders stolen credentials insufficient for network entry.
- **Domain Monitoring**: Organizations should monitor for typosquatting domains targeting their internal infrastructure or preferred vendors.
## Related Tools/Techniques
- **SEO Poisoning**: Used to move fake download sites to the top of search engine results.
- **BitB (Browser-in-the-Browser) Attacks**: Similar concept of using fake UI elements to steal credentials.
- **Living off Trusted Sites**: Leveraging legitimate CDNs to host the final "clean" stage of an attack.