In October 2026, Huntress investigated a fake download site for WatchGuard Mobile VPN with SSL. The page requested VPN credentials and could then supply the genuine installer. For a small business, a routine attempt to reinstall a work tool can therefore expose remote access to its network.
The case involved an administrator at a managed service provider. It illustrates why checking a downloaded file and checking the origin of a password request are separate tasks.
A routine download search becomes the entry point
Huntress traced the October 7 incident to a Bing search for the VPN client. A result led to watchguard-vpn[.]net, a domain impersonating the vendor. The researchers describe search-result poisoning; they do not establish that the administrator clicked a paid advertisement.
WatchGuard had previously documented that domain in a January campaign. That history provides context, but does not establish that the same operators controlled its different versions.
Credentials come before the download
The fraudulent page requested a VPN server address, username and password. Its script rejected the first submission and requested another. After the second, it was designed to retrieve a genuine signed installer from WatchGuard’s distribution infrastructure.
Huntress did not find that download in the investigated browser history. The scripted sequence must therefore be distinguished from what the administrator actually completed. A first submission could nevertheless have exposed credentials.
A signed installer does not validate the web page
A software signature helps verify a program’s origin and integrity. It does not authenticate forms previously displayed on another website. The exposure here concerns a secret entered in the browser, even if the eventual download is legitimate.
An IT provider should also identify which customer owns the VPN server entered into the form. This is more than an endpoint-cleanup question: a remote-access account may provide a route into a customer network. That risk does not establish that such access occurred in this case.
If you entered your VPN credentials
Contact your IT team or provider through a known channel. Give them the account, approximate time and page address, without putting the password into a ticket. Preserve useful browser-history evidence for their investigation.
The team should replace the secret in the system that authenticates VPN connections and review connection activity. Replace reused passwords on other services as well. Finding the genuine client on the computer does not establish that the account is safe.
For small businesses and IT providers
Include a verified download link in your installation procedure instead of requiring staff to find the client through a search engine. Employees should know whom to call if a download page unexpectedly asks for network credentials.
Keep administrative accounts and secrets separate between customer organisations. Review the multifactor authentication and logging options available in your VPN deployment. These are defensive recommendations, not findings about the investigated organisation’s configuration.
How Soclyde relates to this case
Soclyde helps keep distinct business passwords in an encrypted vault on your devices. For an IT provider, locating the correct access details without reusing one secret across customers supports a targeted rotation after a suspicious submission.
Password changes and any session termination must still take place in the VPN infrastructure. Soclyde cannot verify that infrastructure’s integrity or undo a secret submitted to a fraudulent form.
Key points
The WatchGuard lure captures credentials before installation. An authentic download does not make the page requesting your password legitimate. To organise distinct access details and hand them over within a small team, see our guide to sharing passwords securely.
