Cybercriminals have launched a sophisticated attack by creating a counterfeit WatchGuard VPN download site to harvest user credentials. The deceptive site captures sensitive information such as the VPN server address, username, and password through a browser prompt, without deploying a malicious software client.
How the Attack Unfolded
The phishing campaign exemplifies how seemingly safe software searches can lead to credential theft. By leveraging search engine poisoning, attackers can push fake websites to appear in legitimate search results, misleading users into trusting these pages. The research team at Huntress uncovered the scheme during an investigation that began on October 7, involving an administrator at a managed service provider.
Huntress released a report on October 13, detailing how the attack was executed via phishing rather than through a malware-laden installer. User credentials were intercepted within the browser before the legitimate software download was offered.
Details of the Phishing Tactics
The trap was set when an administrator searched for “watchguard vpn sll download” on Bing and was directed to the fraudulent site within seconds. This search engine optimization poisoning, rather than a paid malicious ad, was identified as the method used to lure victims to the site.
The fake site mimicked WatchGuard branding and provided product details to appear credible. However, the download button led to a counterfeit support page, which requested server, login, and password information that seemed routine to VPN users. This tactic is similar to past campaigns involving fake Ivanti download sites.
Security Recommendations and Observations
The phishing domain utilized JavaScript to capture and transmit data in JSON format to a separate server, labeling submissions to determine if it was a first or second attempt. The script would reject the initial entry, prompting users to try again, thus increasing the chance of successful data capture.
After the second attempt, the site facilitated a download of the legitimate WatchGuard Mobile VPN with SSL from the vendor’s content delivery network, verified by Huntress to be unchanged and digitally signed. This differs from prior attacks linked to Storm-2561, which used altered installers.
Preventive Measures and Future Outlook
By October 13, the phishing domain was taken offline. Organizations are advised to reset compromised passwords, consider submitted VPN server addresses as exposed, enforce multifactor authentication, and monitor unusual VPN logins. Employees should rely on bookmarked links to official WatchGuard portals instead of search results. A valid installer signature does not guarantee the safety of credentials handled by the site.
Indicators of compromise have been detailed, including phishing domains and hosting IPs. Organizations are encouraged to update defenses promptly against emerging threats and integrate threat intelligence feeds to stay ahead in cybersecurity.
