# Fake WatchGuard VPN Site Steals Credentials Then Delivers Legitimate Signed Installer

> An SEO-poisoned (Bing) lookalike WatchGuard Mobile VPN with SSL download site harvests VPN server address, username and password through a browser modal and POSTs them to a separate collector domain, then serves the genuine WatchGuard-signed 12.11.5 installer from cdn.watchguard.com. Targeting is aimed at administrators at managed service providers; the October evidence does not independently establish attribution to Storm-2561.

- **Published:** 2026-10-14T10:13:55Z
- **Last reviewed:** 2026-10-14T10:13:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3490
- **ID:** TL-2026-3490
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Huntress observed (October 7-13, 2026) a lookalike site, watchguard-vpn[.]net (registered 2026-08-22, hosted at 80.249.132.140, Site BV/LeaseWeb Netherlands, AS60781), that surfaced in Bing results for the query "watchguard vpn ssl download" via SEO poisoning rather than paid advertising. The page mimics WatchGuard's VPN interface and presents a modal requesting Server, Login and Password.

Harvesting logic lives in popup.js (about 150 lines of unobfuscated JavaScript). Submitted values are packaged as JSON and sent by HTTP POST to a collector at watchguard-ssl[.]online (registered 2026-09-14, hosted at 158.94.209.19, Omegatech LTD, AS202412, Amsterdam), labelled as a "first" or "second" submission. The first submission is deliberately rejected with "Incorrect data, please enter again to start installation", prompting the victim to re-enter (and potentially correct) the credentials. After the second submission the page reports "VPN client installation has started" and JavaScript triggers a download of WG-MVPN-SSL_12_11_5.exe directly from cdn.watchguard.com. That file carries a valid Authenticode signature (signer WatchGuard Technologies, Inc.; issuer Sectigo Public Code Signing CA R36; countersignature timestamp 2025-11-04) and was not tampered with, so the victim sees a clean, legitimate install and no malware is dropped; the theft is purely credential-based. The lure domain went offline by October 13, 2026.

The technique resembles earlier activity: WatchGuard's January 2026 research documented a multi-vendor doppelganger-domain campaign (WatchGuard, F5 BIG-IP, Fortinet, SonicWall, Sophos and others) using SEO poisoning, decoy error prompts and staged downloads, and Microsoft's March 2026 analysis attributed fake-VPN SEO campaigns with signed trojan installers, DLL sideloading (Hyrax infostealer) and redirection to genuine software to Storm-2561. The October activity differs in that it ships a legitimate installer and no malware; the source states it does not independently establish Storm-2561 attribution, so no actor is attributed here. WatchGuard's report notes harvested VPN credentials are likely used for follow-on intrusion such as ransomware deployment (Akira cited in related campaigns), though this is stated as based on prior research rather than direct evidence. Defenders should not treat a valid installer signature as proof that the download journey was safe.

## MITRE ATT&CK

- T1583.001 Domains
- T1608.006 SEO Poisoning
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1056.002 GUI Input Capture
- T1036.005 Match Legitimate Resource Name or Location
- T1071.001 Web Protocols
- T1588.003 Code Signing Certificates
- T1553.002 Code Signing
- T1574.001 DLL
- T1547.001 Registry Run Keys / Startup Folder
- T1555 Credentials from Password Stores

## Sources

- [Fake WatchGuard VPN Site Steals Credentials Then Delivers Legitimate Signed Installer (GBHackers)](https://gbhackers.com/fake-watchguard-vpn-site/)
- [Ongoing Widespread Credential Harvesting Campaign Targets VPN Providers (WatchGuard Secplicity)](https://www.watchguard.com/wgrd-security-hub/secplicity-blog/ongoing-widespread-credential-harvesting-campaign-targets-vpn)
- [Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft (Microsoft)](https://microsoft.com/en-us/security/blog/2026/03/12/storm-2561-uses-seo-poisoning-to-distribute-fake-vpn-clients-for-credential-theft)
- [Credential-stealing crew spoofs VPN clients from Cisco, Fortinet, and others (The Register)](https://www.theregister.com/2026/03/13/vpn_clients_spoofed/)
- [Storm-2561 lures victims to spoofed VPN sites to harvest corporate logins (Security Affairs)](https://securityaffairs.com/189426/cyber-crime/storm-2561-lures-victims-to-spoofed-vpn-sites-to-harvest-corporate-logins.html)
- [Storm-2561: Signed VPN Impersonation via SEO Poisoning (CSA Labs research note)](https://labs.cloudsecurityalliance.org/research/csa-research-note-storm2561-signed-vpn-impersonation-seo-cre/)
- [Storm-2561's Credential Harvesting via Fake VPN Installers (Ampcus Cyber)](https://www.ampcuscyber.com/shadowopsintel/storm-2561-credential-harvesting-via-fake-vpn-installers/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3490