Fake WatchGuard VPN Site Steals Credentials

A sophisticated credential-harvesting campaign is targeting users of WatchGuard VPN clients through SEO poisoning. By manipulating search engine results, attackers lure administrators to lookalike domains—specifically watchguard-vpn[.]net—that mimic official support pages. These sites employ a psychological tactic of rejecting the first login attempt to ensure the accuracy of the harvested credentials and to capture multiple password variations before providing the user with a genuine, signed installer from WatchGuard's own CDN.
This evolution in attack methodology represents a shift away from deploying malware or trojanized binaries, which are easily flagged by endpoint detection systems. Instead, the threat actors leverage the legitimacy of the official software to maintain the illusion of a successful installation, thereby delaying detection. While Microsoft attributed earlier iterations of this campaign to the financially motivated actor Storm-2561, the current iteration's use of legitimate payloads makes the chain significantly harder to detect via traditional security controls. Success depends on the user's trust in search engine rankings and the visual authenticity of the phishing site.

* Campaign targets WatchGuard, F5, Fortinet, SonicWall, and Sophos VPN clients.
* Domains involved include watchguard-vpn[.]com, watchguard-vpn[.]net, and watchguard-ssl[.]online.
* Storm-2561 is a financially motivated actor active since May 2025.
* Initial access is achieved via SEO poisoning on Bing.
* The domain watchguard-vpn[.]net was registered on August 22, 2026.
* The collection endpoint watchguard-ssl[.]online was registered on September 14, 2026.
* Phishing logic is contained in an unobfuscated JavaScript file named popup.js.
* The attack chain requires two credential submissions before triggering a download.
* The final payload is a validly signed WatchGuard Mobile VPN with SSL client (version 12.11.5).
* The legitimate installer is served directly from cdn.watchguard.com.
* The lure domain resolved to 80.249.132[.]140 as of October 9, 2026.
* The collection domain resolved to 158.94.209[.]19.

The strongest version of this narrative is a cautionary technical alert: attackers are bypassing traditional "malware" detections by weaponizing the official software distribution channel. By delivering a legitimate, signed binary, the adversary eliminates the primary signal used by EDR tools, shifting the battlefield entirely to the human psychological layer.
The narrative follows a standard vendor-led threat intelligence pattern. It utilizes the "twist" of the legitimate payload to highlight the insufficiency of signature-based detection, implicitly steering the reader toward the necessity of behavioral monitoring and MFA—services often provided by the authors' own security products.
Patterns detected: ARC-0043 Authority Game, ARC-0021 Fear Appeal
The root cause is the erosion of trust in the "trusted source" paradigm. For years, the security mantra was "check the digital signature." This attack renders that check irrelevant because the signature is real, but the delivery mechanism is fraudulent. It echoes the historical shift from blatant viruses to social engineering, where the payload is not a weapon, but the access itself.
This signifies a loss of agency for the end-user; even a diligent administrator who verifies the file's signature can be compromised. The second-order consequence is a growing "trust deficit" where no single indicator—not search rankings, not digital signatures, not official CDNs—is sufficient for verification.
Bridge Questions:
1. If digital signatures can no longer guarantee a safe installation path, what constitutes a "verifiable" software source in 2026?
2. To what extent does the reliance on SEO for critical infrastructure software create a systemic vulnerability?
Counterstrike Scan: A coordinated influence campaign would use this to push a "death of the perimeter" narrative to force rapid adoption of specific Zero Trust vendors. The current content is a focused technical analysis and does not match this structural pattern.