Fake WatchGuard VPN site steals admin credentials while serving signed client

Huntress found that a lookalike site, watchguard-vpn[.]net, harvested VPN server addresses, usernames and passwords from administrators, then downloaded the genuine WatchGuard Mobile VPN with SSL 12.11.5 client from the vendor's official CDN. The form rejected the first submission to prompt a second entry. Credentials were sent to watchguard-ssl[.]online, registered on September 14, 2026.

• Fake watchguard-vpn[.]net form asked for server address, username and password
• After a second submission it served the genuine Mobile VPN with SSL 12.11.5
• Credential-harvesting domain watchguard-ssl[.]online appeared on September 14, 2026
• The main deceptive domain was offline by October 13