Threat reportPhishingTL-2026-3490
Fake WatchGuard VPN Site Steals Credentials Then Delivers Legitimate Signed Installer
Fake WatchGuard VPN Site Steals Credentials Then Delivers (TL-2026-3490) is a high-severity phishing campaign, first published 2026-10-14. It has no confirmed attribution, affects WatchGuard Mobile VPN with SSL (brand impersonated; no product, maps to 12 MITRE ATT&CK techniques (T1036.005, T1056.002, T1071.001), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-3490
- Threat ID
- TL-2026-3490
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- managed service providers, information technology, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Fake WatchGuard VPN Site Steals Credentials Then Delivers
Malware and tooling: Hyrax
How Fake WatchGuard VPN Site Steals Credentials Then Delivers works
An SEO-poisoned (Bing) lookalike WatchGuard Mobile VPN with SSL download site harvests VPN server address, username and password through a browser modal and POSTs them to a separate collector domain, then serves the genuine WatchGuard-signed 12.11.5 installer from cdn.watchguard.com. Targeting is aimed at administrators at managed service providers; the October evidence does not independently establish attribution to Storm-2561.
Huntress observed (October 7-13, 2026) a lookalike site, watchguard-vpn[.]net (registered 2026-08-22, hosted at 80.249.132.140, Site BV/LeaseWeb Netherlands, AS60781), that surfaced in Bing results for the query "watchguard vpn ssl download" via SEO poisoning rather than paid advertising. The page mimics WatchGuard's VPN interface and presents a modal requesting Server, Login and Password.
Harvesting logic lives in popup.js (about 150 lines of unobfuscated JavaScript). Submitted values are packaged as JSON and sent by HTTP POST to a collector at watchguard-ssl[.]online (registered 2026-09-14, hosted at 158.94.209.19, Omegatech LTD, AS202412, Amsterdam), labelled as a "first" or "second" submission. The first submission is deliberately rejected with "Incorrect data, please enter again to start installation", prompting the victim to re-enter (and potentially correct) the credentials. After the second submission the page reports "VPN client installation has started" and JavaScript triggers a download of WG-MVPN-SSL_12_11_5.exe directly from cdn.watchguard.com. That file carries a valid Authenticode signature (signer WatchGuard Technologies, Inc.; issuer Sectigo Public Code Signing CA R36; countersignature timestamp 2025-11-04) and was not tampered with, so the victim sees a clean, legitimate install and no malware is dropped; the theft is purely credential-based. The lure domain went offline by October 13, 2026.
The technique resembles earlier activity: WatchGuard's January 2026 research documented a multi-vendor doppelganger-domain campaign (WatchGuard, F5 BIG-IP, Fortinet, SonicWall, Sophos and others) using SEO poisoning, decoy error prompts and staged downloads, and Microsoft's March 2026 analysis attributed fake-VPN SEO campaigns with signed trojan installers, DLL sideloading (Hyrax infostealer) and redirection to genuine software to Storm-2561. The October activity differs in that it ships a legitimate installer and no malware; the source states it does not independently establish Storm-2561 attribution, so no actor is attributed here. WatchGuard's report notes harvested VPN credentials are likely used for follow-on intrusion such as ransomware deployment (Akira cited in related campaigns), though this is stated as based on prior research rather than direct evidence. Defenders should not treat a valid installer signature as proof that the download journey was safe.
MITRE ATT&CK techniques used in TL-2026-3490
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location
Credential Access
T1056.002 GUI Input Capture; T1555 Credentials from Password Stores
Command and Control
Execution
Persistence
T1547.001 Registry Run Keys / Startup Folder
defense-impairment
Initial Access
stealth
Resource Development
T1583.001 Domains; T1588.003 Code Signing Certificates; T1608.006 SEO Poisoning
Affected products and versions in Fake WatchGuard VPN Site Steals Credentials Then Delivers
- WatchGuard — Mobile VPN with SSL (brand impersonated; no product vulnerability)
Remediation for Fake WatchGuard VPN Site Steals Credentials Then Delivers
Immediate actions
- Block watchguard-vpn[.]net, watchguard-ssl[.]online, 80.249.132.140 and 158.94.209.19 at DNS, proxy and firewall (use real values without brackets)
- Search proxy/DNS/EDR telemetry for connections to the lure and collector domains since 2026-08-22
- Reset VPN credentials for any user or admin who entered Server/Login/Password on a lookalike WatchGuard page and review VPN logs for logins from unfamiliar sources
Workarounds
- Download WatchGuard Mobile VPN with SSL only from watchguard.com or WatchGuard-provided portals
- Use a password manager so credentials are not typed into unfamiliar pages
Longer-term hardening
- Enforce MFA on all VPN and remote-access accounts
- Have staff reach vendor software only by typing the vendor URL or using bookmarks, not search results
- Validate the full download chain (domain, referrer) rather than relying on installer signature validity
- Enable browser and network protection and SmartScreen-style reputation controls; disable browser password syncing on managed devices
- Train MSP administrators on lookalike-domain verification
Weaknesses (CWE) in Fake WatchGuard VPN Site Steals Credentials Then Delivers
Timeline of Fake WatchGuard VPN Site Steals Credentials Then Delivers
- Microsoft reports Storm-2561 (related fake-VPN SEO campaigns, not attributed to the October activity) active since at least May 2025 (exact day not stated).
- Countersignature timestamp on the legitimate WatchGuard-signed WG-MVPN-SSL_12_11_5.exe later delivered by the fake site.
- WatchGuard research documents a widespread multi-vendor doppelganger-domain credential harvesting campaign (WatchGuard, F5, Fortinet, SonicWall, Sophos and others) with watchguard-vpn domains.
- Microsoft publishes analysis of Storm-2561 SEO-poisoned fake VPN clients (signed trojan MSI, DLL sideloading, Hyrax infostealer, redirect to genuine vendor).
- Lure domain watchguard-vpn.net registered.
- Credential collector domain watchguard-ssl.online registered.
- Huntress begins observing the lure site surfacing in Bing results for 'watchguard vpn ssl download'; credential modal flow and legitimate installer hand-off analyzed.
- Lure site observed offline by October 13.
- GBHackers publishes report on the fake WatchGuard VPN site based on Huntress research.
Sources cited for Fake WatchGuard VPN Site Steals Credentials Then Delivers
- Fake WatchGuard VPN Site Steals Credentials Then Delivers Legitimate Signed Installer (GBHackers)
- Ongoing Widespread Credential Harvesting Campaign Targets VPN Providers (WatchGuard Secplicity)
- Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft (Microsoft)
- Credential-stealing crew spoofs VPN clients from Cisco, Fortinet, and others (The Register)
- Storm-2561 lures victims to spoofed VPN sites to harvest corporate logins (Security Affairs)
- Storm-2561: Signed VPN Impersonation via SEO Poisoning (CSA Labs research note)
- Storm-2561's Credential Harvesting via Fake VPN Installers (Ampcus Cyber)
Detection coverage for TL-2026-3490
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3490 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3490
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.