Cybercriminals Use Fake WatchGuard VPN Support Site to Steal Credentials Through SEO Poisoning
Cybercriminals set up a counterfeit WatchGuard support website designed to harvest VPN credentials before supplying the legitimate client software. The operation was uncovered by Huntress researchers while investigating a security incident that occurred on October 7 at a managed service provider.
Victims arrived at the fake site through ordinary Bing search results for the query watchguard vpn sll download. The malicious domain used was watchguard-vpn.net. Researchers attributed the traffic to SEO poisoning rather than paid malicious advertisements.
The fraudulent page closely replicated the official WatchGuard support layout, complete with frequently asked questions and a prominent download button. Clicking the button opened a form requesting three fields: Server, Login, and Password.
The attackers employed a simple but effective social-engineering trick. The first submission was always rejected with the message Incorrect data, encouraging the victim to re-enter the information. Only on the second attempt did a hidden link deliver the genuine installer WG-MVPN-SSL_12_11_5.exe, which carried a valid digital signature.
Credential collection was handled by an approximately 150-line JavaScript script that transmitted the data in JSON format via HTTP POST to a second domain. Network errors during this step produced only a browser console warning, leaving the victim unaware of any issue.
As a result, the user received and installed the correct VPN client with no visible signs of compromise, while the attackers obtained the server address and credentials. No additional malware was delivered. The phishing site, whose footer described it as an independent fan site, went offline on October 13.
Security recommendations include changing any exposed passwords, treating disclosed server addresses as known to attackers, enforcing multi-factor authentication, and reviewing VPN login logs for anomalies. Users should download software exclusively from the official portal using bookmarks rather than search engine results.
Related articles
AI-Powered Drainer Scams Target IT Job Seekers via Malicious Repositories and Fake Recruiters
IT hiring has become a fertile ground for drainer scams that trick candidates into running malicious code under the guise of technical interviews. Scammers pose as recruiters on job platforms, offering roles that require downloading projects from private repositories or installing browser extensions for supposed corporate tools. These attacks often lead to crypto wallet drainers stealing funds, with victims reporting losses around $2000 in documented cases. AI tools are heavily used by attackers to generate realistic job postings, LinkedIn profiles, deepfake videos for calls, and obfuscated malicious code hidden in test assignments. Candidates are advised to inspect package.json, lock files, and CI/CD configurations before any execution and to use AI assistants like Claude for static analysis without running the code. The trend has grown amid mass layoffs and economic uncertainty, turning desperate job searches into opportunities for financial theft.
Marketplace Scraping in 2026: Why Timer-Based IP Rotation Undermines Parsers
Analysis of one full day of telemetry from MobileProxy.Space reveals how marketplace anti-fraud systems detect scrapers through session continuity and rotation patterns rather than IP reputation alone. Over 2 million IP changes were recorded across 8,878 modems, with a median of 95 unique addresses per modem. Timer-driven rotations accounted for 60.2% of all changes, and 92.2% of those intervals were exact multiples of one minute, with a median of 120 seconds. Such rigid periodicity stands out against natural mobile network behavior where address changes occur irregularly due to cell handovers or PDP context resets. The data also shows that 73.1% of address changes complete within five seconds, yet duplicate rotation commands still occur in 0.8% of link-triggered events. The recommended approach ties rotation to parser session state, recreates cookies and TLS profiles on each change, and waits for address confirmation before resuming requests.
Bank Transfer Comments Such as 'Bribe' or 'To the Common Pot' Risk Triggering Compliance Reviews
Lawyer Meri Valishvili warned that casual or joking comments added to bank transfers can prompt automated compliance checks and account restrictions. Systems scan payment descriptions for terms like 'bribe', 'kickback', or 'to the common pot' without assessing humorous intent. No single public list of flagged phrases exists, as each bank independently configures its monitoring algorithms. Even routine descriptions such as 'for manicure' or 'utilities payment' may raise flags when combined with regular amounts or recurring patterns. Valishvili advises private individuals to omit unnecessary comments and to reference specific contract numbers and dates when a transfer has legal significance. For group collections, she recommends using bank-provided tools that clearly state the purpose of the payment.
How to Secure Your Gosuslugi Account Against Hacks and Recover Access After Takeover
Russia's Gosuslugi portal now holds far more than basic documents, including tax notifications, child records, data-sharing consents, and access to other government services, making account security critical. The guide stresses using a unique strong password, enabling two-factor authentication with TOTP or biometrics instead of SMS, and regularly reviewing active sessions and connected mobile apps. It details steps to add a trusted contact for recovery, audit consents granted to third parties, and monitor for unauthorized logins or statements. In case of suspicious codes or calls, users must never share verification codes and should immediately check actions in the system, revoke unknown consents, and contact support. If access is lost, recovery options include online password reset with passport data or in-person visits to service centers, followed by credit history checks and self-imposed credit bans via Gosuslugi starting March 2025. The advice also covers protecting the linked phone number and email to prevent SIM swaps and further fraud.