As noted by Tech Radar, a sophisticated phishing scheme has been uncovered where a fake WatchGuard VPN website successfully stole administrator credentials by posing as a legitimate download portal. The fraudulent site not only mimicked the official WatchGuard pages but also delivered the authentic VPN client software to unsuspecting users.
Security researchers at Huntress identified a deceptive website, watchguard-vpn[.]net, which tricked users searching for WatchGuard VPN downloads. The site presented a form requesting server address, username, and password, information crucial for the VPN client's installation. Upon submission, these details were sent to a separate attacker-controlled domain. The malicious script was designed to reject the initial submission, prompting the user to re-enter their credentials, thereby increasing the chances of capturing the correct information. After successfully harvesting the credentials, the fake website initiated a download of the genuine WatchGuard Mobile VPN with SSL client from the official content delivery network. This tactic cleverly bypassed many security measures, as the downloaded software was legitimate and digitally signed by WatchGuard, leaving users with no immediate reason to suspect a compromise. The attack targeted administrators, potentially granting attackers access to sensitive corporate networks. Organizations are advised to reset compromised passwords, enforce multi-factor authentication, and ensure employees always use official download sources.
Source: Tech Radar
