Fake VPN Portal Steals Corporate Admin Logins While Delivering Genuine Software

Cybersecurity investigators have uncovered a sophisticated credential-harvesting campaign that relies on a deceptive website mimicking official software distribution channels. Rather than bundling malicious payloads into modified applications, the operation relies on social engineering to collect sensitive login credentials through a browser interface before delivering legitimate, cryptographically signed software to avoid tripping standard endpoint protection tools.

The activity came to light after analysts at Huntress examined suspicious events tied to an administrator at a managed service provider. According to the investigation, the user searched for a WatchGuard VPN client via a search engine and landed on a lookalike domain named watchguard-vpn[.]net. The fraudulent landing page requested typical connection parameters, including server addresses, usernames, and passwords, disguised as a necessary step for downloading a mobile VPN with SSL client.

Instead of processing the installation locally, the deceptive portal transmitted entered details to a secondary domain designated for credential collection. The malicious script deliberately rejected initial inputs and wiped input fields, prompting victims to re-enter their information and inadvertently providing attackers with multiple validation attempts. Once the harvesting sequence concluded, the browser redirected the download directly to official content delivery networks, providing an authentic, unmodified installer bearing a valid digital signature.

Security experts emphasize that this tactic effectively evades traditional file-inspection mechanisms because the downloaded binary remains entirely untampered. Because the installation proceeds normally and delivers functioning software, victims typically lack any immediate indicators of compromise. Analysts recommend that affected organizations immediately audit administrator logs, enforce robust multi-factor authentication policies, reset compromised passwords, and remind personnel to verify direct navigation to official vendor domains for software downloads.