A WatchGuard VPN phishing operation was uncovered in October 2026 that steals credentials directly in the browser rather than dropping malware onto endpoints. The campaign uses lookalike WatchGuard domains and an SEO-poisoned search result to lure IT administrators and managed service providers to a fake support page. When a user clicks a download link, an unobfuscated JavaScript file collects three fields—Server, Login, and Password—through a modal prompt.
The first submission is deliberately rejected to induce a second, more careful entry, after which the attacker transmits the credentials to a remote server and then initiates the download of the genuine WatchGuard Mobile VPN with SSL installer from the vendor’s official CDN. The researchers note that the final binary is unmodified, meaning no trojanized installer or malicious DLL is present on disk.
Evidence from Huntress and Microsoft Threat Intelligence links the operation to a broader credential-harvesting campaign and possible links to the Storm-2561 actor, though attribution remains unproven for the October renewal. In the observed incident, a MSP administrator performing a Bing search for a WatchGuard download was redirected within eight seconds to the spoofed domain; the site even included a product-questions section to boost its ranking.
Practically, organisations should reset any credentials entered on suspicious pages, treat the entered VPN server address as compromised, and enforce multi-factor authentication for remote access. Defences should include monitoring VPN login attempts from unfamiliar hosting providers or regions and blocking lookalike domains alongside official vendor download portals.