Hackers Use Fake WatchGuard VPN Download Site to Steal Login Credentials
Cybercriminals are impersonating WatchGuard's VPN download portal to trick users into revealing their login credentials before providing the legitimate software.
A sophisticated phishing campaign is targeting users seeking to download WatchGuard VPN software by employing a fake download website designed to harvest sensitive login credentials. Researchers from Huntress discovered the operation, which leverages search engine poisoning to place the malicious site prominently in search results, leading unsuspecting administrators directly into the trap.
The attack begins when a user searches for "watchguard vpn sll download" on a search engine like Bing. The fake website, masquerading as an official WatchGuard portal, appears in the search results. Upon clicking the link, users are presented with a familiar interface that includes WatchGuard branding and information about the VPN client. This deceptive presentation aims to build trust and encourage users to proceed with the download.
Instead of directly offering the installer, the fake site redirects users to a simulated support page where they are prompted to enter their VPN server address, username, and password. This information is captured by a JavaScript payload embedded within the page. The attackers designed the process to appear as a standard login or configuration step, making it less likely for users to suspect foul play.
Crucially, the attackers do not deliver a malicious installer. After the user submits their credentials, the script processes the input. If it's the first attempt, the form displays an "Incorrect data" message, potentially prompting the user to re-enter their credentials, thereby providing attackers with a second chance to capture accurate information. Once a second submission is made, the script allows the download of the legitimate, digitally signed WatchGuard Mobile VPN with SSL client from the vendor's official content delivery network.
This tactic bypasses the need for malware-laden installers, which are often detected by security software. By focusing solely on credential harvesting through a seemingly legitimate download process, the attackers exploit user trust and the common practice of searching for software online. The campaign's success hinges on the user's assumption that a high search ranking equates to a safe download source.
This method bears resemblance to previous attacks that used fake download sites, such as those targeting Ivanti VPN clients. However, the WatchGuard campaign's unique approach of capturing credentials directly within the browser before serving the genuine installer represents a notable evolution in credential theft techniques. The attackers also employed a secondary domain to receive the captured JSON data, further obscuring their infrastructure.
Organizations affected by this campaign should reset all exposed passwords, treat the submitted VPN server addresses as compromised, and enforce multi-factor authentication for all VPN connections. Users are strongly advised to use bookmarked links to official vendor portals for software downloads rather than relying on search engine results, as a valid installer signature does not guarantee the safety of the download source.
The lure domain used in this campaign was taken offline shortly after its discovery. However, the underlying technique of search engine poisoning and credential harvesting through fake download sites remains a significant threat, highlighting the need for increased user vigilance and robust security awareness training.