Beware of fake VPN downloads: stealing credentials

Recently, a fraudulent website mimicking WatchGuard VPN's download pages has been found to steal login credentials from administrators while providing legitimate software. Security investigators at Huntress traced this activity to a lookalike domain that collected connection details before allowing the download of the authentic client.

The issue began when suspicious activity involving an administrator from a managed service provider was detected. This administrator had searched Bing for the WatchGuard VPN download and was led to a deceptive site that appeared legitimate. The attackers managed to collect VPN server addresses, usernames, and passwords from unsuspecting users.

## Why it matters These types of attacks are particularly dangerous because users tend to trust they are downloading official software, making them less cautious. The combination of a fraudulent website with legitimate software can give attackers direct and prolonged access to corporate networks, increasing the risk of data breaches and other cyberattacks.

## What we know Investigators have confirmed that the fake site not only tricked users into giving up their credentials but also rejected initial data submissions to gather additional information on a second attempt. This indicates a level of sophistication in the attackers' strategy, aiming to maximize information theft.

## What is still unclear It is still unclear how many users have been affected by this attack or if authorities have taken action to shut down the fraudulent site. WatchGuard has not issued an official statement regarding this situation, leaving users uncertain about the security of their systems.