MSPs Lured by SEO Poisoning to Fake WatchGuard Site That Stole Credentials Before Delivering Real VPN Client
Attackers used SEO poisoning to lure admins to a fake download page that harvested login details before providing the real software.
Key points
- The campaign targeted managed service providers searching for VPN client downloads.
- Victims received the genuine WatchGuard installer after their credentials were stolen.
- Huntress identified the activity using the lookalike domain watchguard-vpn[.]net.
Huntress reported in October that a credential theft campaign targeted administrators seeking WatchGuard VPN clients. The attack used a fake download site to steal login details before serving the legitimate vendor installer.
The campaign used search engine optimization poisoning to place the malicious domain in search results. Users who clicked the link encountered a page mimicking the WatchGuard website. It requested server addresses, usernames, and passwords before initiating the download.
Attack mechanics
Huntress observed an administrator at a managed service provider search for the client on Bing in October. Eight seconds later, the user visited the spoofed site. The page submitted the entered credentials to a remote server via HTTP POST.
After harvesting the data, the site triggered a download of the real WatchGuard installer from the official CDN. This step ensured the victim received valid software.
Who is affected
Microsoft Threat Intelligence previously linked similar activity to the financially motivated actor Storm-2561. Earlier iterations of the campaign distributed malicious executables. The October variant simplified the chain by removing the fake client entirely.
The attack involved users downloading the WatchGuard Mobile VPN with SSL application. Huntress noted the main domain was offline by October 13. WatchGuard was notified of the infrastructure details before publication.
Defender's checklist
Organizations should monitor for failed login attempts from unexpected sources. Review download logs for connections to unofficial domains. Verify that all software installations originate from verified vendor repositories.
Check browser history for recent searches related to VPN clients. Ensure that administrators are aware of the risk posed by SEO-poisoned results. Train staff to verify domain names before entering credentials.
Operational impact
When a credential theft campaign targets specific vendor tools, operations teams must assess the scope of potential exposure. Managers should determine which administrative accounts accessed the affected downloads. IT leaders need to verify if any stolen credentials were reused across other systems.
Security teams usually recommend resetting passwords for any accounts that interacted with the compromised site. Organizations should also review access logs for unusual VPN connection attempts. Communication with suppliers is essential to understand if their tools were also targeted. Internal stakeholders, including legal and compliance, should be informed to evaluate risk implications.
Background: SEO poisoning
SEO poisoning does not require hacking your website. Attackers manipulate search rankings by creating decoy pages that look legitimate. Users click these results expecting help but land on sites that install malware or steal credentials. Protection requires monitoring search results, not just securing your own server.
Read the full guide: SEO Poisoning Myths: Why Your Site Is Not the Only Target
What to do and how to stay safe: WatchGuard
- Verify the domain name of any software download page before entering credentials.
- Monitor authentication logs for failed or unusual login attempts following software downloads.
- Ensure that administrative staff only obtain software from official vendor portals.
- Review browser history for recent visits to lookalike domains.
Step-by-step guide: Incident Response Plans: Why Your Security Tools Fail Without One
General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does the fake site install malware on the user's computer?
No, the site serves the legitimate, signed WatchGuard installer after stealing credentials.
How did the attackers trick users into visiting the fake site?
They used SEO poisoning to rank the malicious domain high in search results.
Is the malicious domain still active?
Huntress reported that the main domain was offline as of October 13.
