CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

WatchGuard Mobile VPN with SSL

product · product:watchguard-mobile-vpn-with-ssl single-source

Coverage
1
first 2026-10-15 → last 2026-10-15
Latest activity
2026-10-15
Huntress: a lookalike VPN-client site harvests credentials, then hands over the real signed installer
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
1
1 hosts

Defender insights

What each entry about WatchGuard Mobile VPN with SSL tells a defender to do, newest first.

2026-10-15NOTABLEHuntress: a lookalike VPN-client site harvests credentials, then hands over the real signed installer

Exposure · triage · detection

Story timeline

  1. 2026-10-15A fake WatchGuard VPN download site captures the SSL VPN server, login and password in the browser and then serves the genuine signed installer, leaving no malicious file for endpoint tools to flag
    active-threatsHuntress: a lookalike VPN-client site harvests credentials, then hands over the real signed installer

Hunting pivots

Releases covered
WatchGuard Mobile VPN with SSL
Tags
identityphishing
ATT&CK techniques (3 across 2 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Resource DevelopmentAcquire Infrastructure: Domains · Stage Capabilities: SEO Poisoning
  • ExecutionUser Execution: Malicious Link

Resource Development TA0042

T1583.001Acquire Infrastructure: Domains×1

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.

Evidence: 2026-10-15/fake-watchguard-vpn-client-site-credential-capture · ATT&CK page ↗

T1608.006Stage Capabilities: SEO Poisoning×1

Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms.

Evidence: 2026-10-15/fake-watchguard-vpn-client-site-credential-capture · ATT&CK page ↗

Execution TA0002

T1204.001User Execution: Malicious Link×1

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.

Evidence: 2026-10-15/fake-watchguard-vpn-client-site-credential-capture · ATT&CK page ↗

Entries about WatchGuard Mobile VPN with SSL (1)

2026-10-15 · view entry permalink →

NOTABLENATOB2

A fake WatchGuard VPN download site captures the SSL VPN server, login and password in the browser and then serves the genuine signed installer, leaving no malicious file for endpoint tools to flag

Huntress's SOC investigated an incident on 2026-10-07 in which an administrator at a managed service provider searched Bing for a WatchGuard VPN download with a typo in the query and clicked through the standard Bing result redirect to a lookalike site titled "WatchGuard Firebox VPN Client", which Huntress classes as search-engine poisoning rather than malvertising (Huntress, 2026-10-13). Choosing any download option opens a pop-up asking for Server, Login and Password; one unobfuscated JavaScript file of about 150 lines posts the typed values as JSON to a separate collector domain, tagged as the first or second attempt, and always rejects the first submission with an "incorrect data" message so that the victim types again or tries a second set of credentials (Huntress, 2026-10-13). Only after the second submission does the page fetch the real WatchGuard Mobile VPN with SSL installer from WatchGuard's own CDN, an Authenticode-signed file whose digest Huntress recomputed and found unmodified, so there is no trojanized installer or malicious DLL for endpoint defenses to flag (Huntress, 2026-10-13). The victim's browser history showed no download in the observed window, so Huntress judges the user probably did not finish both rounds but may have typed credentials in the first, and Managed Defender flagged the incident 21 seconds after the lookalike domain loaded (Huntress, 2026-10-13). Both domains were registered within the previous two months, few reputation engines flagged either as of 2026-10-08, and the lure domain was offline by 2026-10-13 (Huntress, 2026-10-13). Huntress places the iteration in a campaign that WatchGuard's Secplicity team described in January 2026 as lookalike download sites for WatchGuard, F5, Fortinet, SonicWall and Sophos clients, and that Microsoft tied in March 2026 to a financially motivated actor it tracks as Storm-2561; the new element is that the fake client is gone from the middle (Huntress, 2026-10-13).

Triage: a genuine VPN client also asks for server, login and password, but only inside the installed client at connect time; a browser form that collects the three values before any installer has run, on a domain that is not the vendor's, is the signal.

Rather than downloading a fake client, the domain instead downloads a genuine, validly signed WatchGuard installer.

The legitimate Mobile VPN with SSL client also asks for these three values when users connect, so the prompt looks reasonable.

Huntress 2026-10-13
threat15 Oct 03:43Zsingle-sourceOpen finding →
Sources: Huntress

explore in graph

Where this entity is cited

  • Threats1

Source distribution

  • huntress.com1 (100%)
All cited sources (1)