Fake WatchGuard VPN Site Harvests Admin Logins, Grants Hackers Direct Network Access

A counterfeit website masquerading as WatchGuard's VPN download portal has been uncovered stealing administrator credentials from corporate users, effectively opening a backdoor into corporate networks. By presenting a legitimate, digitally signed version of the VPN client, the scheme avoids raising suspicion, allowing attackers to silently capture sensitive login details.

Security researchers traced the operation to a phishing page that initially rejected users' first login attempts, prompting a second submission. This deliberate rejection forces victims to re‑enter their usernames, passwords, and VPN server addresses, which are then harvested by the threat actors.

The stolen information includes full administrator usernames and passwords, as well as the specific VPN server endpoints used by the organizations. With these details, malicious actors can bypass typical perimeter defenses and gain unfettered remote access to internal systems, potentially escalating privileges or exfiltrating data.

WatchGuard, a well‑known provider of network security solutions, has confirmed that the software distributed through the fake site is authentic and correctly signed, underscoring the sophistication of the campaign. The attackers rely on the trust users place in official binaries to conceal their malicious intent, a tactic that highlights the growing challenge of credential‑theft attacks that exploit legitimate tools.

Experts advise organizations to enforce multi‑factor authentication for VPN access, regularly audit privileged accounts, and verify download sources through official channels or trusted repositories. As the investigation continues, cybersecurity teams are urging enterprises to review recent VPN login logs for any anomalous activity that could indicate compromise.