New Cyberattack: Fake VPN Website Steals User Credentials
How the Fraudulent Scheme Works
Cybersecurity researchers have identified a sophisticated new attack targeting the access credentials of corporate network administrators. The attackers have created a deceptive website that visually mimics the official WatchGuard portal. Users searching for VPN software are frequently redirected to this malicious resource.
The site prompts users to download the "Mobile VPN with SSL" client and requests a server address, username, and password. This request appears legitimate, as such data is required for actual VPN configuration. However, the entered information is sent directly to the attackers' servers. Furthermore, the site intentionally rejects the initial login attempt, prompting the user to re-enter their credentials, which allows the attackers to harvest additional data.
Legitimate Files to Dispel Suspicion
The most dangerous aspect of this attack is that after the credentials are stolen, the website provides the user with genuine, official software. The file is downloaded from WatchGuard's official server and carries the company's authentic digital signature. Because the program is not modified and contains no malicious code, security systems do not flag it as suspicious.
Victims who successfully download and install the official software may not realise their administrator credentials have already been compromised. This strategy differs significantly from traditional methods, where attackers embed malicious code directly into software packages, which antivirus programs often detect.
How to Protect Yourself
Experts advise exercising caution when downloading software to defend against such attacks. First, always ensure you are on the official domain rather than a deceptive "fake" site. Additionally, it is recommended to enable two-factor authentication (2FA) on all corporate accounts, which will protect your network even if a password is stolen.
If you suspect your credentials have been compromised, change your passwords immediately and check your VPN login history for suspicious activity. For organisations, the best practice is to provide employees with direct links to official downloads, ensuring they do not need to rely on search engines where attackers can gain high rankings through advertisements or SEO manipulation.