Fake VPN download site steals administrator credentials to give attackers direct access to corporate networks —…

https://cdn.mos.cms.futurecdn.net/natgb5M8TLEd5x6jw9mHSd-1920-80.jpg
  • Fake WatchGuard VPN website steals administrator credentials while delivering legitimate software
  • Attackers collected VPN server addresses, usernames, and passwords
  • The fraudulent website rejected initial submissions to collect credentials a second time

A fraudulent WatchGuard download website stole VPN login details while supplying the authentic installation package, experts have claimed.

Security investigators at Huntress traced the activity to a lookalike domain that collected connection details before downloading the legitimate client.

The investigation began after suspicious activity involving an administrator working for a managed service provider was detected.

Fake download pages harvest user credentials

Investigators found that the user had searched Bing for a WatchGuard VPN download before visiting a deceptive website designed to resemble the vendor's official download pages.

The website, watchguard-vpn[.]net, offered a purported mobile VPN with SSL download and displayed a form requesting the server address, username, and password.

Those details matched information required by the genuine VPNclient,...

Copyright of this story solely belongs to www.techradar.com. To see the full text click HERE