Cybersecurity researchers have identified a phishing campaign that tricked users into sharing their WatchGuard VPN credentials through a fake software download website This article explores downloads legitimate watchguard. . The attack uses a domain that closely mimics the official WatchGuard website to collect sensitive information, including the VPN server address, username, and password.

Unlike traditional malware campaigns, this attack delivers the genuine, digitally signed WatchGuard VPN installer after obtaining the credentials. Attackers exploit users' curiosity to steal credentials without altering legitimate software or installing malware. When Bing users search for WatchGuard VPN, an unsuspecting administrator clicks on watchguard-vpn[. ]net, a fraudulent site that mimics the official download page.

The site provides a download link for the WatchGuard Mobile VPN with SSL client, along with product details and FAQs, making it appear legitimate.

When users click the download option, a pop-up asks them to input three details: the VPN server address, login name, and password. After the second submission, the phishing page displays a success message and downloads the legitimate WatchGuard Mobile VPN with SSL installer directly from WatchGuard’s official content delivery network. The domain watchguard-vpn[.

]net, previously identified in research from WatchGuard's Secplicity team in January 2026, is used as a lookalike for routine VPN downloads.