Fake WatchGuard VPN download takes passwords before serving the real client

An administrator looking for the WatchGuard SSL VPN client landed on a lookalike download site that asks for the server address and credentials used for VPN access before starting a real installer download. Huntress investigated the October 7 visit from a managed service provider account.

That last step is the trap. A validly signed installer can leave a user with a working VPN client even after the site has sent their credentials to someone else. Huntress says its Managed Defender flagged this particular visit 21 seconds after the malicious domain loaded, and its team gave the organization remediation steps. A signed file alone is therefore a poor test of whether the download journey was safe.

A search leads to the impostor

Huntress traced the visit to an administrator searching Bing for “watchguard vpn sll download.” Eight seconds later, the browser reached www[.]watchguard-vpn[.]net through a normal Bing search-result redirect. The page called itself “WatchGuard Firebox VPN Client”; its download options led to an imitation support page. The observed search-result path supports Huntress’s SEO-poisoning assessment for this visit.

The domain is a useful hunt value, even though Huntress says it was offline as of October 13. WatchGuard had listed the domain in January research into lookalike VPN downloads; by October it hosted a working browser credential form. Huntress says it notified WatchGuard and shared infrastructure details before publishing its findings.

The password leaves before installation

The download buttons on the imitation support page opened a prompt for Server, Login and Password. Those are also the values the legitimate Mobile VPN with SSL client requests when it connects, so the prompt fits the user’s task. The server field gives the operator a destination for the stolen login. Huntress found the form logic in popup.js: it sent the entered values as JSON to watchguard-ssl[.]online, with a tag distinguishing the first submission from the second.

After the first submission, the script cleared the fields and displayed “Incorrect data, please enter again to start installation,” according to Huntress. A user who tries another password can expose two candidates. After the second submission, the page started a download from WatchGuard’s cdn.watchguard.com. Huntress checked the Mobile VPN with SSL installer, version 12.11.5, and found a valid WatchGuard Authenticode signature matching its recomputed digest. This attack collects secrets in the browser rather than by changing that executable.

In the investigated browser history, Huntress saw no CDN download in the relevant interval. The page initiated that download only after the second form submission, so investigate a possible first submission even if the installer never arrived. A visit by itself warrants checking browser and network records for a form POST and asking the user what they entered.

Trace the visit and VPN access

Search managed browser history, secure-web-gateway logs and DNS records for the lure watchguard-vpn[.]net and the collector watchguard-ssl[.]online. Huntress associated the lure with 80.249.132[.]140 and the collector with 158.94.209[.]19 as of its investigation; use those IPs with the domains and time window rather than as permanent ownership labels. Where proxy or browser telemetry records requests, correlate visits to the lure with submissions to the collector; the genuine installer gives endpoint malware detection nothing malicious to flag.

For an account that submitted a password, reset the affected password and review the VPN server named in the prompt. Check SSL VPN authentication logs for that account and server, especially successful or repeated attempts from hosting providers, unfamiliar ASNs and countries the account has not used. Inspect any subsequent access with the privileges of that login. Where the login belongs to an MSP administrator, include the customer VPN endpoints that administrator could reach. Enforce MFA on the affected VPN access and verify the rule actually challenges a fresh login; a stolen password then loses its direct path into the VPN.

Give staff a known download path

Block the two identified domains in web controls and distribute a bookmarked client-download link through your own administrator documentation. WatchGuard’s software portal presents its Software Downloads page; have staff start there rather than from a search-result download page. For the exposed account, a clean signed installer is no substitute for a password reset and a review of VPN logins. Confirm the new password works with MFA, the old credential fails, and the relevant login history has been examined for use from unfamiliar networks.