TI Mindmap HUB
Threat Intelligence Report

Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client

📅 October 14, 2026 📰 www.huntress.com 🔍 0 CVE(s) referenced

An SEO-poisoned fake WatchGuard VPN site steals credentials twice before delivering the genuine signed client from WatchGuard’s CDN, leaving endpoint defenses with no malicious payload to detect.

vendor

Sign in to access the full report including:
detailed analysis, IOCs, MITRE ATT&CK mapping, and STIX bundle.

🔐 Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

📊 Visual Mindmap
🎯 IOC Extraction
⚔️ MITRE ATT&CK TTPs
📦 STIX 2.1 Bundle