Cybercriminals Use Fake WatchGuard VPN Support Site to Steal Credentials Through SEO Poisoning
Cybercriminals set up a counterfeit WatchGuard support website designed to harvest VPN credentials before supplying the legitimate client software. The operation was uncovered by Huntress researchers while investigating a security incident that occurred on October 7 at a managed service provider.
Victims arrived at the fake site through ordinary Bing search results for the query watchguard vpn sll download. The malicious domain used was watchguard-vpn.net. Researchers attributed the traffic to SEO poisoning rather than paid malicious advertisements.
The fraudulent page closely replicated the official WatchGuard support layout, complete with frequently asked questions and a prominent download button. Clicking the button opened a form requesting three fields: Server, Login, and Password.
The attackers employed a simple but effective social-engineering trick. The first submission was always rejected with the message Incorrect data, encouraging the victim to re-enter the information. Only on the second attempt did a hidden link deliver the genuine installer WG-MVPN-SSL_12_11_5.exe, which carried a valid digital signature.
Credential collection was handled by an approximately 150-line JavaScript script that transmitted the data in JSON format via HTTP POST to a second domain. Network errors during this step produced only a browser console warning, leaving the victim unaware of any issue.
As a result, the user received and installed the correct VPN client with no visible signs of compromise, while the attackers obtained the server address and credentials. No additional malware was delivered. The phishing site, whose footer described it as an independent fan site, went offline on October 13.
Security recommendations include changing any exposed passwords, treating disclosed server addresses as known to attackers, enforcing multi-factor authentication, and reviewing VPN login logs for anomalies. Users should download software exclusively from the official portal using bookmarks rather than search engine results.
Related articles
Google Strengthens Chrome Defenses Against ClickFix Clipboard-Based Scams
Google has updated Chrome to detect and warn users about malicious commands copied to the clipboard as part of ClickFix attacks. These scams trick users into pasting harmful scripts into system tools such as PowerShell under the guise of fixing errors or providing tech support. The new protections activate when Enhanced Protection in Safe Browsing is enabled and send suspicious commands for analysis after removing personal data. Google has also shifted scam page detection from a local Gemini model to a server-side implementation to improve accuracy against fake tech support, antivirus, and browser update sites. The changes make it harder for attackers to bypass browser download checks by abusing clipboard and system console execution. Official details were published in the Google Security Blog.
SPF, DKIM and DMARC: Practical Guide to Detecting Email Spoofing and Phishing
The article explains how email authentication mechanisms SPF, DKIM, and DMARC work together to combat spoofed messages that impersonate trusted services. It provides concrete DNS record examples and shows how to interpret Authentication-Results headers in received emails. SPF verifies authorized sending IP addresses but does not check the visible From address. DKIM adds cryptographic signatures to message content and headers, while DMARC ties these checks to the sender domain visible to users and defines handling policies. The guide also covers common configuration errors, forwarding issues, and why successful authentication does not guarantee message safety. It concludes that these protocols must be combined with additional security measures such as attachment scanning and user awareness training.
JPAAWG 9th General Meeting to Examine AI-Driven Messaging Threats and Global Standards in Tokyo
The Japan Anti-Abuse Working Group will hold its ninth annual General Meeting on November 5-6, 2026, in Tokyo as a hybrid event focused on evolving messaging security challenges. Keynote speaker Tom Bartel from M3AAWG will address worldwide anti-abuse trends and the practical realities of AI-powered attacks and defenses. Sessions will cover the recently standardized DMARCbis specification under RFC 9989, ongoing work on DKIM2 to counter replay attacks, BIMI logo display adoption, and sender guidelines for AI-generated email summaries. Practical workshops will teach DMARC report analysis using real sample data along with related technologies such as ARC, DNSSEC, and MTA-STS. Government agencies including the National Police Agency and Ministry of Internal Affairs and Communications will also present, alongside a dedicated track on post-quantum cryptography.
AI-Powered Drainer Scams Target IT Job Seekers via Malicious Repositories and Fake Recruiters
IT hiring has become a fertile ground for drainer scams that trick candidates into running malicious code under the guise of technical interviews. Scammers pose as recruiters on job platforms, offering roles that require downloading projects from private repositories or installing browser extensions for supposed corporate tools. These attacks often lead to crypto wallet drainers stealing funds, with victims reporting losses around $2000 in documented cases. AI tools are heavily used by attackers to generate realistic job postings, LinkedIn profiles, deepfake videos for calls, and obfuscated malicious code hidden in test assignments. Candidates are advised to inspect package.json, lock files, and CI/CD configurations before any execution and to use AI assistants like Claude for static analysis without running the code. The trend has grown amid mass layoffs and economic uncertainty, turning desperate job searches into opportunities for financial theft.