OTX Threat: Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client

In early October, a sophisticated credential phishing campaign targeted WatchGuard Mobile VPN users through a fake download site at watchguard-vpn[.]net. The attack used SEO poisoning to appear in search results and deployed a unique technique: after collecting victim credentials twice through browser pop-ups, it downloaded the genuine, validly signed WatchGuard installer directly from WatchGuard'