WatchGuard SEO Poisoning: Fake Site Harvests VPN Logins Before Serving Legitimate Client

Huntress researchers identified a credential-harvesting campaign that impersonates WatchGuard VPN download pages. The attack steals authentication details from users before serving the legitimate, signed installer. This method allows attackers to capture credentials without installing malicious software on the victim's machine.

What happened

An administrator at a managed service provider searched Bing for a VPN client download on October 7. They clicked a link to watchguard-vpn[.]net, a site designed to mimic the official WatchGuard website. The page presented a prompt requesting the VPN server address, username, and password. This request appeared as part of the installation process, making it seem legitimate to the user.

The site used JavaScript to capture these inputs and send them via HTTP POST to watchguard-ssl[.]online. After the first submission, the script rejected the data and asked the user to try again. Huntress noted this could capture corrected credentials or an alternative password, although that intent remains an analytical assessment. Once the second submission was made, the site triggered a download of the real WatchGuard installer from the vendor's CDN.

Microsoft Threat Intelligence previously linked this wider campaign to Storm-2561, a financially motivated actor. Earlier iterations involved fake executables, but this latest version relies solely on browser-based credential theft. Huntress confirmed the main domain was offline as of October 13, following their notification to WatchGuard.

Why it matters

This attack demonstrates how SEO poisoning can compromise trusted search results. Users often trust high-ranking links, assuming they lead to official vendor sites. By serving the legitimate installer after stealing credentials, attackers reduce the likelihood of immediate detection. Victims may believe they successfully installed the software, unaware their access details are compromised. This approach lowers the barrier for attackers, who no longer need to distribute malicious binaries.

Next steps

• Verify that all VPN client downloads originate from the official vendor website, not search results.
• Monitor for unusual login attempts from unexpected locations or devices.
• Enforce multi-factor authentication for all VPN access to mitigate credential theft.
• Review browser history for visits to lookalike domains or suspicious redirects.

Detection notes

Teams usually detect this activity by reviewing web proxy logs for visits to lookalike domains. Check whether users accessed sites with slight variations of the vendor's name. Look for HTTP POST requests containing JSON payloads with login credentials. Monitor for repeated failed login attempts followed by successful ones from the same source. Containment moves should include forcing password resets for affected accounts and revoking active sessions.

What to do and how to stay safe: WatchGuard

• Train staff to verify URLs before downloading software from search results.
• Implement strict DNS filtering to block known malicious lookalike domains.
• Enable logging for all VPN connection attempts to identify unauthorized access.
• Review browser extensions for any that might manipulate search results.

Step-by-step guide: How to Prevent Account Takeover: The Technical Controls That Actually Work

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What specific domain was used in this WatchGuard attack?

The primary domain used was watchguard-vpn[.]net, which impersonated the official site.

Did the attack install any malicious software on the victim's device?

No, the attack served the legitimate, signed WatchGuard installer after stealing credentials.

Who is behind this credential-harvesting campaign?

Microsoft attributed the wider campaign to Storm-2561, a financially motivated threat actor.