# Fake WatchGuard VPN Site Steals Credentials

SEO-poisoned lookalike WatchGuard VPN site harvests server/login/password via popup.js, then serves the genuine signed installer from WatchGuard's CDN.

- Payout: Real-world hack
- Severity: high
- Program: WatchGuard
- Analysis by: Huntress
- Disclosed: 2026-10-13
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/fake-watchguard-vpn-credential-phishing
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-fake-watchguard-vpn-credential-phishing
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:high tech:cdn technique:recon vuln:misconfiguration vuln:secrets-leak

**Target:** WatchGuard Mobile VPN with SSL client download / credential prompt
**Root cause:** Typosquatted domain ranked in Bing results impersonates WatchGuard download page; unobfuscated popup.js posts typed server/login/password as JSON to an attacker collector, forcing a second attempt, then downloads the legitimate signed installer to avoid suspicion.
**Steps:**
1. Victim searches Bing for `watchguard vpn sll download` and clicks bing.com/ck/a redirect with `u=aHR0cHM6Ly93d3cud2F0Y2hndWFyZC12cG4ubmV0Lw` to `www.watchguard-vpn[.]net`
2. Download page at `watchguard-vpn[.]net/index.php` shows popup asking for Server, Login, Password
3. popup.js wraps input in JSON and POSTs to `watchguard-ssl[.]online` tagged with attempt number
4. First submission is rejected: fields cleared, header set to `Incorrect data, please enter again to start installation`, `attempt = 2`
5. Second submission accepted; script creates hidden link to `https://cdn.watchguard.com/SoftwareCenter/Files/MUVPN_SSL/12_11_5/WG-MVPN-SSL_12_11_5.exe` and clicks it
**How found:** Huntress SOC triaged a Managed Defender alert on an MSP admin account; browser history showed a Bing search for 'watchguard vpn sll download' and an 8-second-later click to the lookalike domain, leading to analysis of popup.js and the download flow.
**Exploitation:** SEO poisoning places lookalike domain atop Bing results; victim enters VPN server address and credentials into fake modal, which are exfiltrated to watchguard-ssl[.]online; forced retry yields a second credential set; genuine signed installer is then delivered so the victim sees expected behavior and no malware is present to flag.
**Insight:** Credential phishing can drop the malware entirely: harvest secrets in-browser, then serve the vendor's own signed installer from its CDN so EDR has nothing to flag. Check whether the download URL resolves to the legitimate vendor CDN and whether the page's JS posts form data off-domain before assuming a signed binary means safety.

## Proof of concept (copied exactly from the original report)

**popup.js posts credentials to collector**

```
The submission handler sends the form contents to the collection domain:
Loading Gist...

The user's typed input is wrapped in JSON and posted to watchguard-ssl[.]online, tagged to indicate whether this is the first or second attempt. The fetch is wrapped in a try/catch statement that only logs a console warning on failure, so even if the collector is down, the user sees nothing unusual.
```

**Hidden download of genuine signed installer**

```
const DOWNLOAD_FILE = 'https://cdn.watchguard.com/SoftwareCenter/Files/MUVPN_SSL/12_11_5/WG-MVPN-SSL_12_11_5.exe';
This is WatchGuard's official CDN.
```