Unraveling the Alarming SEO-Poisoning Campaign Targeting WatchGuard Users
Huntress researchers have recently unveiled a sophisticated phishing campaign aimed at stealing SSL VPN credentials. The scheme leverages a counterfeit website designed to mimic the legitimate WatchGuard download page, leading victims to unknowingly provide their credentials before receiving the actual, validly signed installer from WatchGuard’s content delivery network. This clever approach leaves endpoint detection and response (EDR) tools virtually powerless, as no malicious alterations or malware are introduced into the installation process.
This troubling discovery was detailed in a report by the Huntress Security Operations Center (SOC) on October 13. At the center of this campaign is the domain watchguard-vpn[.]net, which masquerades as a download portal for WatchGuard’s Mobile VPN with SSL client. In stark contrast to prior iterations of such campaigns that employed trojanized installers to distribute malware, this recent version strips away any malicious components entirely, making it even more insidious.
How It All Started
The investigation conducted by Huntress began on October 7 when an administrator from a managed service provider searched for “watchguard vpn ssl download” through the Bing search engine. A mere eight seconds later, this individual unwittingly clicked on the link leading to the fake site via a standard Bing search result redirect. Huntress attributed this rapid redirection to an SEO poisoning strategy rather than malicious advertising, marking a shift in how cybercriminals are exploiting search engine results to trap unsuspecting victims.
The Credentials Snatching Mechanism
Once victims land on the fraudulent site, clicking any of the available download options triggers a pop-up that requests vital information: the VPN server address, username, and password. These are identical to what the legitimate client would request, creating an illusion of authenticity. The underlying logic for this credential collection is found within approximately 150 lines of unobfuscated JavaScript, known as popup.js. The script employs a method whereby the entries are submitted as JSON to a secondary domain, watchguard-ssl[.]online.
What follows is a clever, albeit nefarious, technique where the first submission of credentials is always met with an “incorrect data” message, aiming to coax victims into retyping their information or attempting different passwords. This dual submission tactic allows the perpetrators to secure a second and often more accurate set of credentials, inclusive of the necessary server address for potential access.
Delivering the Real Deal
After successfully receiving the second set of credentials, the malicious script initiates the download of WatchGuard’s genuine Mobile VPN with SSL installer, specifically version 12.11.5, straight from the official cdn.watchguard.com. Huntress validated the file’s Authenticode signature, confirming that the binary had remained unaltered. Thus, the unsuspecting victim receives the installation they anticipated, while defenders are left with little to identify, as no trojanized installer or side-loaded DLL exists to raise alarms.
Detection efforts proved minimal; as of October 8, only seven VirusTotal vendors recognized the lure domain, while just two flagged the data collector. This highlights the sophisticated nature of the attack and the measures the criminal elements have taken to evade detection.
The Backstory of the Domain
The Secplicity team at WatchGuard initially flagged watchguard-vpn[.]net in January as part of a broader credential-harvesting campaign that targeted not only WatchGuard but also competitors such as F5, Fortinet, SonicWall, and Sophos. However, during that time, the domain lacked a functional backend. Microsoft later connected this related activity to Storm-2561, a financially motivated group known to have been operational since May 2025. According to WHOIS data, the domain was re-registered on August 22, followed by the collector domain on September 14. While Huntress cannot determine whether the same operators were behind both registrations, the evolving landscape of this attack is striking.
During the investigation, Huntress flagged the malicious activity just 21 seconds after site loading. Browser history indicated that the user did not proceed with both rounds of credential submissions. By October 13, the fraudulent domains had gone offline, and Huntress promptly shared the associated infrastructure details with WatchGuard for further examination.
Recommendations for Users
In light of these findings, experts recommend several crucial actions for users to safeguard their credentials:
-
Password Reset: Users should promptly reset passwords for any account where information was entered on the fraudulent site and treat the associated VPN endpoint as compromised.
-
Enable Multi-Factor Authentication (MFA): Implementing MFA on SSL VPN access can provide an additional layer of security.
-
Monitor Login Attempts: Organizations should keep an eye on VPN logins originating from hosting providers, unfamiliar autonomous system numbers (ASNs), or new countries.
-
Block Malicious Domains: Users and administrators should block access to watchguard-vpn[.]net, watchguard-ssl[.]online, and the associated IPs, 80.249.132[.]140 and 158.94.209[.]19.
- Bookmark Official Links: It is advisable to publish and keep a record of official download links, such as software.watchguard.com, to prevent confusion when attempting to download legitimate software.
For those interested in further details, Huntress published comprehensive research on the matter, which can be reviewed to gain deeper insight into this alarming trend in cyber threats.
For the complete research, visit Huntress Blog.
In a digitally interconnected world, remaining vigilant is more critical than ever, as cyber threats continue to evolve.