A credential-theft campaign uncovered by security firm Huntress shows just how little a victim needs to do wrong to hand over the keys to their corporate network: a routine search, a plausible-looking result, and a login prompt that looks exactly like the one they’d expect to see.

A Search That Led to a Lookalike Site

Huntress investigators were called in after an October 7 incident involving an administrator at a managed service provider. Browser history showed the administrator had searched Bing for a WatchGuard VPN client download, clicked through to what appeared to be WatchGuard’s own site within eight seconds, and landed on a page carrying the company’s branding, product descriptions, and even a mocked-up support FAQ.

The evidence pointed to search engine optimization poisoning rather than a paid malicious ad: the site had apparently been engineered to rank well for the exact phrasing IT staff tend to type in when they need a VPN client in a hurry. It’s a tactic cybersecurity researchers have flagged repeatedly in recent years, and one that undermines a habit many users rely on for safety, trusting whatever appears near the top of a search results page.

The Capture Mechanism

Clicking the download button didn’t trigger a file download at all. Instead, it opened a form requesting three pieces of information: a VPN server address, a username, and a password, the exact fields a real WatchGuard SSL VPN client would ask for. Because the request matched what a legitimate connection attempt looks like, there was little about it to raise suspicion.

Behind the scenes, roughly 150 lines of JavaScript quietly packaged whatever the victim typed into a JSON payload and sent it off to a separate collection server via an HTTP POST request. Each submission was tagged to indicate whether it was a first or second attempt, a detail that turns out to matter.

That’s because the page was designed to reject the first submission outright, clearing the form and displaying an “Incorrect data” error regardless of what was entered. Many users, assuming they’d simply mistyped a password, try again, which is exactly the point: the operators wanted two sets of credentials rather than one, in case a mistyped password on the first attempt made the stolen data useless.

The Payoff: A Genuine, Signed Installer

Only after the second submission did the page turn its error message green and quietly trigger a download, not of malware, but of the actual WatchGuard Mobile VPN with SSL client, version 12.11.5, pulled directly from WatchGuard’s own official content delivery network. Huntress confirmed the file’s digital signature was valid and its contents unmodified.

That design choice separates this campaign from more familiar vendor-impersonation schemes, where attackers bundle malware or a tampered DLL into a fake installer. Here, the victim who completes the download walks away with working, legitimate software and may never suspect anything happened, even though their VPN credentials, and potentially the address of their organization’s VPN gateway, are already sitting on an attacker-controlled server.

Caught Fast, But the Exposure Still Matters

In the incident Huntress investigated, its Managed Defender service flagged the suspicious activity just 21 seconds after the page loaded, and browser history showed no evidence the WatchGuard installer had actually been downloaded, suggesting the administrator may not have completed the second form submission. Still, Huntress couldn’t rule out that a first set of credentials had already gone through.

The phishing domain itself was taken offline by the time Huntress published its findings on October 13, though the firm noted a related domain had been registered and used in earlier campaign activity, suggesting this kind of lure may resurface under a new name.

What Organizations Should Do

• Treat any VPN credentials entered on a search-result page, rather than a bookmarked or internally distributed link, as potentially compromised and reset them.
• Assume any VPN server address typed into such a form is now known to attackers, and monitor for connection attempts against it.
• Enforce multifactor authentication on VPN logins so a stolen password alone isn’t enough to gain access.
• Direct staff to bookmark the official WatchGuard software portal rather than relying on search engines to find vendor downloads.
• Remember that a valid digital signature on a downloaded file says nothing about whether the site that served it handled your credentials safely beforehand.

The episode is a useful reminder that phishing doesn’t always involve a fake or broken program. Sometimes the lure is just a login box in front of the real thing.