Fake VPN Site Creates Panic: Your Data is in Danger

A fake WatchGuard VPN download page uses genuine software to steal users' corporate credentials. Details are in our news.

A new type of attack has been detected that aims to steal corporate credentials through a fake WatchGuard VPN download page. Security researchers state that attackers are deceiving users by using the original software as a shield.

Investigations conducted by Huntress revealed that attackers created a deceptive domain that mimicked WatchGuard's official download pages. This fake website displays a form that requests users to enter VPN server address, username and password information.

Deceptive Method That Steals Credentials

Attackers aim to collect victims' VPN connection details using the watchguard-vpn[.]net address. The information sent through the form is transmitted to a different domain called watchguard-ssl[.]online, which is controlled by the attackers.

The system rejects the entered information the first time and asks the user to re-enter the data. This method allows attackers to gain access to multiple password attempts.

Researchers found that this fake download domain was registered on August 22, 2026. It was determined that the other domain name that collected identity information appeared on September 14.

Attackers follow a very careful method so that users do not become suspicious. After the second data entry, the site downloads the original installation package from WatchGuard's official content distribution network, rather than a fake software.

The downloaded file appears to be Mobile VPN with SSL client version 12.11.5, digitally signed by WatchGuard Technologies. Huntress confirmed that the installation file is genuine and that the attackers did not make any changes to the software.

Safety Precautions and Remediation

This approach differs from traditional attacks that distribute malware-containing or modified files. Providing genuine software makes it difficult for victims to suspect that their credentials have been stolen.

Security teams state that many endpoint protection products cannot detect the situation because the attack occurs through the browser. Huntress reported that the main decoy domain was offline as of October 13th.

It is of great importance for organizations to take immediate measures against a possible breach. Experts recommend resetting all passwords and making sure multi-factor authentication is enabled.

Additionally, VPN logins need to be checked for suspicious activity and employees should only be directed to official software download pages. What do you think about these types of cyber attack methods?