Huntress traces an MSP administrator's mistyped Bing search to a WatchGuard lookalike site

The query had a typo. The administrator searched Bing for "watchguard vpn sll download" and clicked through eight seconds later, according to Huntress ^[9]. The click ran through Bing's standard bing.com/ck/a redirect, with the destination encoded in the u= parameter ^[10]. Huntress treats that redirect, together with the domain's apparent search-result placement, as evidence of SEO poisoning and not malvertising ^[10]. The site also carried a "WatchGuard Mobile VPN Questions" section that Huntress described as likely meant to bolster search ranking ^[11].

The payload has changed since the first reports. In January, WatchGuard's researchers documented a .NET executable, hosted in a GitHub repository, that impersonated the Mobile VPN with SSL client and forwarded whatever credentials a victim typed into it to a command-and-control server ^[3]. Microsoft's later account, tied to watchguard-vpn[.]com, described a signed fake MSI that sideloaded malicious DLLs and then showed an installation error pointing the victim to the real vendor download ^[6]. In October, watchguard-vpn[.]net delivered a genuine, validly signed WatchGuard installer ^[7].

That domain looked different in January. According to the researchers, it then had "no backend logic to direct users to the spoofed downloads page" ^[4]. By October it had a download page at /index.php posing as a "WatchGuard Support Page" ^[13].

Huntress found the domain offline as of October 13, six days after Managed Defender flagged the activity on October 7 ^[8][14]. It notified WatchGuard before publishing and shared the infrastructure details ^[15]. Whether the operators have moved to another domain is not stated.

Attribution is separate from observation. Microsoft attributed the wider campaign iteration to Storm-2561, a financially motivated actor active since May 2025 ^[5]. Huntress called the October incident consistent with earlier reports of the campaign ^[7]. In the portion of its post available to us, Huntress does not name an actor, and the text ends at the download page, so how the October chain captured credentials is not established here.

The page's only on-page warning is a line at the bottom: "An independent English-language fan site about WatchGuard Mobile VPN. Not an official sales, download, or support channel." ^[12]

We think the control that holds is where the download starts. A staff member who opens the vendor's own domain from a bookmark never sees the search result. And because the October installer is genuine and validly signed, a check of the file's publisher would not separate it from the real one ^[7].