Home / Technology / Fake Site Steals WatchGuard VPN Logins
Fake Site Steals WatchGuard VPN Logins
18 Oct
Summary
- A fake website stole administrator credentials for WatchGuard VPN.
- Attackers collected VPN server addresses and user login information.
- The fraudulent site delivered legitimate software after stealing data.
A fraudulent WatchGuard download website recently stole administrator VPN login credentials, according to security investigators. This malicious site, resembling WatchGuard's official download pages, prompted users to enter their VPN server address, username, and password.
The collected information was transmitted to a separate domain operated by attackers. Notably, the fraudulent website then initiated a download of the genuine WatchGuard Mobile VPN client, a tactic that helped mask the credential theft as the installer was legitimate and digitally signed.
This method bypasses many security checks since the fake website steals credentials via the browser before providing authentic software. The main deceptive domain was reported offline as of October 13, 2026. Organizations are advised to reset compromised passwords and enable multi-factor authentication.
