Fake WatchGuard VPN Site Steals Credentials

What it is

A credential-phishing chain aimed at WatchGuard Mobile VPN with SSL users. The lure is watchguard-vpn[.]net, reached through search results (SEO poisoning, per Huntress). The collector is watchguard-ssl[.]online. Huntress caught it on October 7 when an MSP administrator searched Bing for "watchguard vpn sll download" (note the typo) and clicked through eight seconds later. Managed Defender flagged it 21 seconds after the page loaded.

How it works

• The "download" buttons open a popup (popup.js, about 150 lines, unobfuscated) asking for Server, Login and Password. The Server field gives the attacker the VPN gateway address.
• The first submission is always rejected with "Incorrect data, please enter again", and attempt is set to 2. The attacker gets a second candidate set, with each POST tagged by attempt number.
• Submissions are POSTed as JSON to watchguard-ssl[.]online. A try/catch swallows failures, so the victim sees nothing even if the collector is down.
• Only after the second submission does the script fetch https://cdn.watchguard.com/SoftwareCenter/Files/MUVPN_SSL/12_11_5/WG-MVPN-SSL_12_11_5.exe. This is an unmodified Inno Setup installer, version 12.11.5, signed by WatchGuard Technologies, Inc. (Sectigo Public Code Signing CA R36). Huntress verified the Authenticode digest matches.

Preconditions / Affected

• The victim finds the lookalike through search and enters VPN credentials into the popup.
• The VPN must be reachable with the harvested credentials. MFA is the control that breaks the chain after theft.
• Endpoint tooling has nothing to flag: no malware, and the installer is genuine.

What to do

• Block watchguard-vpn[.]net and watchguard-ssl[.]online. Also block the IPs below.
• 80.249.132[.]140 (lure; Site BV / LeaseWeb NL, AS60781)
• 158.94.209[.]19 (collector; Omegatech LTD, AS202412, Amsterdam)
• Enforce MFA on SSL VPN. Alert on VPN logins from hosting providers, unfamiliar ASNs, or countries new to the account.
• If anyone entered credentials, reset every affected account's password. Treat the VPN endpoint named in the Server field as known to the attacker.
• Publish and bookmark official download links in client documentation, including software.watchguard.com.
• Hunt on web or proxy logs for visits to the two domains, not on endpoint detections. Only 7 VirusTotal vendors flagged the lure domain and 2 flagged the collector as of October 8, and AbuseIPDB had no reports.

Caveats

• A missing cdn.watchguard.com download in browser history does not prove no theft. The download only fires after the second submission, but the first set was already posted. In the Huntress case the user likely did not finish both rounds, yet may have submitted once.
• watchguard-vpn[.]net was offline as of October 13.
• The domain was re-registered after WatchGuard's January observation (it moved from 74.208.236[.]39 to the current IP). Huntress says the evidence does not establish that the same operators ran both registrations.