Fake WatchGuard Download Page Harvests Logins Before Offering Genuine Software

The Short Version

A fake WatchGuard VPN download page collected connection details before offering genuine software, according to a Huntress investigation reported by TechRadar. The page requested a VPN server address, username and password, then sent those details to a separate domain controlled by the attackers.

Why It Matters

The trick placed credential theft before the software download. Investigators found that the page rejected the first submission and cleared its fields, encouraging another attempt. After the second submission, its download flow supplied the authentic WatchGuard installer from the vendor’s content delivery network.

TechRadar reports that the file carried a valid WatchGuard signature and that Huntress found it unchanged after signing. A legitimate file therefore offered no reassurance about what the preceding webpage had done with the login details.

The Bigger Picture

The distinction is between trusting a program and trusting the route used to obtain it. In this reported setup, inspecting the installer alone would miss the earlier credential collection. The familiar-looking form also requested information used by the real VPN client, helping it resemble an ordinary installation step.

That does not establish that attackers entered the organization’s network. In the incident Huntress investigated, no download from the official server was recorded, suggesting the user might not have completed both submissions.

What to Watch

The reported scope remains limited. Huntress said the main deceptive domain was offline by October 13, but that observation does not establish whether related infrastructure remains active. TechRadar recommends using official download pages, resetting compromised passwords, enabling multifactor authentication and checking for suspicious VPN logins.

Would a genuine installer reassure you after a download page had already asked for your VPN password?