Fake VPN download site steals administrator credentials while delivering legitimate software

Security researchers at Huntress have uncovered a sophisticated phishing campaign targeting WatchGuard VPN users. A deceptive website, watchguard-vpn.net, masqueraded as an official portal, tricking administrators into entering their VPN credentials under the guise of an installation process. The site employed a two-step submission tactic to capture login data before redirecting users to download the genuine, digitally signed WatchGuard software from the official content delivery network. By delivering legitimate, untampered files, the attackers successfully avoided detection by traditional endpoint security tools that typically look for malicious code. The incident highlights a growing trend where attackers leverage trusted software to mask credential harvesting operations. Experts advise organizations to enforce multifactor authentication, monitor for suspicious VPN access patterns, and ensure employees only download software from verified, official vendor domains to mitigate the risk of such credential theft.