Skip to content
Credential Harvesting Campaign Targets WatchGuard VPN Users

Credential Harvesting Campaign Targets WatchGuard VPN Users

First seen 13 Oct 2026, 22:05 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 00:08 UTC
  • •Credential harvesting campaign targets WatchGuard VPN users.
  • •Attackers use doppelganger domains to deliver malicious software.
  • •Microsoft linked the campaign to the actor Storm-2561.

A credential harvesting campaign has been identified targeting users of WatchGuard's Mobile VPN with SSL. The campaign utilizes doppelganger domains, including watchguard-vpn[.]com and watchguard-vpn[.]net, to deliver malicious software that captures user credentials. The attack method involves redirecting users from search engines to spoofed download pages, where a legitimate WatchGuard installer is served, but it is compromised to send credentials to a command-and-control server. Microsoft Threat Intelligence linked the campaign to the financially motivated actor Storm-2561, active since May 2025. As of October 13, the domain watchguard-vpn[.]net was reported offline, and Huntress has notified WatchGuard of the ongoing campaign. The incident highlights the risks associated with searching for software downloads online, particularly when using search engines that may inadvertently promote malicious sites.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-01-05
Credential harvesting campaign identified
WatchGuard's Secplicity team reported on a campaign using doppelganger domains to steal credentials.
Huntress
2026-10-07
Suspicious activity flagged
Huntress Managed Defender flagged suspicious activity linked to watchguard-vpn[.]net, indicating ongoing credential theft efforts.
Huntress
2026-10-13
Domain reported offline
As of October 13, the domain watchguard-vpn[.]net was confirmed to be offline, following Huntress's notification to WatchGuard.
Huntress

More articles in this cluster (2)

Following this threat?

Track Storm-2561 and WatchGuard in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 3

Common questions

How can I tell if I'm affected?
Check if you have downloaded software from the domains watchguard-vpn[.]com or watchguard-vpn[.]net.
What should I do if I suspect credential theft?
Immediately change your passwords and monitor for unusual account activity.
Are there any patches available?
No specific patches have been mentioned; focus on monitoring and securing your credentials.