A fake WatchGuard VPN download site captures the SSL VPN server, login and password in the browser and then serves the genuine signed installer, leaving no malicious file for endpoint tools to flag

Huntress's SOC investigated an incident on 2026-10-07 in which an administrator at a managed service provider searched Bing for a WatchGuard VPN download with a typo in the query and clicked through the standard Bing result redirect to a lookalike site titled "WatchGuard Firebox VPN Client", which Huntress classes as search-engine poisoning rather than malvertising (Huntress, 2026-10-13). Choosing any download option opens a pop-up asking for Server, Login and Password; one unobfuscated JavaScript file of about 150 lines posts the typed values as JSON to a separate collector domain, tagged as the first or second attempt, and always rejects the first submission with an "incorrect data" message so that the victim types again or tries a second set of credentials (Huntress, 2026-10-13). Only after the second submission does the page fetch the real WatchGuard Mobile VPN with SSL installer from WatchGuard's own CDN, an Authenticode-signed file whose digest Huntress recomputed and found unmodified, so there is no trojanized installer or malicious DLL for endpoint defenses to flag (Huntress, 2026-10-13). The victim's browser history showed no download in the observed window, so Huntress judges the user probably did not finish both rounds but may have typed credentials in the first, and Managed Defender flagged the incident 21 seconds after the lookalike domain loaded (Huntress, 2026-10-13). Both domains were registered within the previous two months, few reputation engines flagged either as of 2026-10-08, and the lure domain was offline by 2026-10-13 (Huntress, 2026-10-13). Huntress places the iteration in a campaign that WatchGuard's Secplicity team described in January 2026 as lookalike download sites for WatchGuard, F5, Fortinet, SonicWall and Sophos clients, and that Microsoft tied in March 2026 to a financially motivated actor it tracks as Storm-2561; the new element is that the fake client is gone from the middle (Huntress, 2026-10-13).

Triage: a genuine VPN client also asks for server, login and password, but only inside the installed client at connect time; a browser form that collects the three values before any installer has run, on a domain that is not the vendor's, is the signal.