---
title: Hunt: fake WatchGuard VPN site steals SSL-VPN creds, then serves the genuine signed installer | ctxsec
url: https://ctxsec.com/items/hunt-watchguard-vpn-phish
description: ""
status: "hunt idea"
published: 2026-10-13
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-watchguard-vpn-phish.md)

hunt idea

2026-10-13

### Hunt: fake WatchGuard VPN site steals SSL-VPN creds, then serves the genuine signed installer

Huntress traced an Oct 7 MSP incident to an admin who Bing-searched "watchguard vpn sll download" and landed on `watchguard-vpn[.]net`, which Huntress classifies as SEO poisoning. When the admin clicked download, a `popup.js` modal asked for Server, Login and Password. It always rejects the first submission to harvest a second credential set, then POSTs JSON to `watchguard-ssl[.]online`. After that it downloads the _real_ Authenticode-signed WG-MVPN-SSL 12.11.5 from `cdn.watchguard.com`, so there is no malicious file for EDR to catch. The detection surface is browser, DNS and VPN-auth logs. IOCs: `80.249.132[.]140` (lure) and `158.94.209[.]19` (collector). Response: reset any credentials entered, enforce MFA on SSL VPN, and publish the official download link (`software.watchguard.com`).

```
// KQL sketch: lure/collector contact, then VPN logins from new ASNs
let iocs = dynamic(["watchguard-vpn.net","watchguard-ssl.online"]);
DeviceNetworkEvents
| where RemoteUrl has_any (iocs) or RemoteIP in ("80.249.132.140","158.94.209.19")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
// then pivot: Firebox SSL-VPN auth logs for those users from hosting ASNs / never-seen countries
```

Sources: [Huntress](https://www.huntress.com/blog/fake-watchguard-vpn-credential-phishing)