Security firm Huntress said on October 13 that it investigated a VPN credential-theft scheme in early October. It started with a fake download page for WatchGuard's Mobile VPN with SSL client, at watchguard-vpn[.]net. A pop-up asked visitors for their VPN server address, username and password. Huntress said the page rejects the first try as wrong, so the visitor types again. After the second try, it downloads the real, signed installer from WatchGuard's own servers. Huntress said an administrator at a managed service provider reached the page through a Bing search on October 7.
Huntress said its monitoring flagged the activity 21 seconds after the page loaded. Browser history showed no installer download, so Huntress believes the user did not finish both rounds. They may still have typed credentials once. Huntress said the domain was offline on October 13. It said its evidence cannot show whether the same operators ran the January and August registrations of the domain. Huntress did not say how many people entered credentials.
The installer is genuine, so no malicious file exists for endpoint security tools to flag. Huntress said only seven VirusTotal vendors flagged the fake domain as of October 8. Huntress advises teams to require multi-factor authentication and to share official download links with staff.