SEO poisoning tricks MSP admins into handing over WatchGuard credentials via fake download pages

This credential-harvesting campaign targets users seeking to download the WatchGuard Mobile VPN client. Instead of delivering malicious code, the attack steals authentication details through a browser-based prompt and subsequently provides the vendor’s genuine, signed installer. This approach allows attackers to collect valid login information while leaving the victim with legitimate software, thereby reducing the likelihood of immediate detection by endpoint security tools.

How it unfolded

• In January 2026, WatchGuard’s Secplicity team reported a campaign using lookalike domains to steal credentials from VPN clients.
• Microsoft later attributed the wider campaign to Storm-2561, noting the use of fake installers that sideloaded malicious DLLs.
• In October, Huntress observed an iteration using watchguard-vpn[.]net that harvested data via JavaScript before serving the real installer.

Who is affected

The incident impacted an administrator at a managed service provider who searched for the VPN client on Bing. According to Huntress, the user clicked a link to watchguard-vpn[.]net, which impersonated the official vendor site. The page requested the server address, username, and password. After the user submitted these details, the script prompted a second entry, potentially to capture corrected credentials or alternative passwords, before initiating the download of the authentic software package.

The fix

No vendor patch or update has been confirmed for this specific phishing campaign. The threat relies on user interaction with a fraudulent website rather than a vulnerability in the WatchGuard software itself. Huntress notified WatchGuard about the active campaign and shared infrastructure details prior to publishing its findings. The primary domain associated with this specific incident was offline as of October 13, according to the researcher’s report.

What analysts watch for

Teams usually monitor for unexpected credential submissions to non-vendor domains. Check whether download prompts request authentication details before the client is installed. Examine browser console logs for JavaScript that packages form data into JSON payloads. Look for redirects through search engine tracking parameters that lead to lookalike domains. Verify that any installer hashes match those published on the official vendor website. Review network traffic for outbound POST requests containing sensitive fields during download processes.

What to do and how to stay safe: WatchGuard

• Verify the URL of any download page carefully, ensuring it matches the official vendor domain exactly.
• Never enter VPN credentials into a browser prompt; authentication should occur within the installed client application.
• Use password managers to detect when a login field is not on the expected, trusted domain.
• Monitor logs for failed login attempts followed by successful connections from unexpected sources.

Step-by-step guide: Incident Response Plans: Real Benefits and Hidden Costs

General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this malware install on the computer?

No, the latest iteration serves the genuine WatchGuard installer, so no malicious executable is installed on the endpoint.

Who is behind this campaign?

Microsoft attributed the wider campaign to Storm-2561, a financially motivated actor active since May 2025.

How did the victim find the fake site?

The administrator found the site via a Bing search, suggesting the attackers used SEO poisoning to rank the domain.