Uncovering A Mass VPN Phishing Campaign - The 443 Podcast - Episode 355

January 20, 2026·38 min·2 clips

A phishing campaign targeted WatchGuard, SonicWall, Check Point, Fortinet, F5, and other VPN providers.

1. The 443 - Security Simplified covers a WatchGuard Threat Lab investigation into a mass phishing campaign against VPN users. 2. Martha Liberty hosts Corey, while WatchGuard researchers Mark and Ryan are referenced for the campaign report and technical research. 3. The episode asks how attackers can imitate trusted VPN software, exploit appliance vulnerabilities, and manipulate Copilot into exposing data. 4. A WatchGuard customer found a malicious VPN client after searching Google for “WatchGuard VPN client” and clicking the first result. 5. The phishing domain watchguard-vpn.com delivered a ZIP archive from GitHub containing an executable named vpn-client.exe. 6. The counterfeit client copied WatchGuard’s interface, branding, wording, and version number but did not install the tunnel driver required by the legitimate software. 7. The fake client displayed a “VPN client version is not supported” message while sending usernames, passwords, and VPN server information to command-and-control infrastructure. 8. SEO poisoning placed phishing pages near the top of Bing and other search results for terms including “WatchGuard VPN.” 9. The phishing website checked search-engine referrers, Windows usage, and browsers including Chrome, Safari, Firefox, and Opera before showing the download link. 10. Horizon 3 AI described FortiSIEM vulnerabilities that combined unauthenticated argument injection with privilege escalation to produce unauthenticated remote code execution. 11. The FortiSIEM chain used the handle storage request endpoint, the elastic-test-url.sh script, and curl command behavior. 12. Horizon 3 AI used curl’s “--next” behavior and the “-o” option to download and overwrite a license-tool binary. 13. A writable script launched through a root cron entry allowed the researchers to obtain a root shell on the FortiSIEM appliance. 14. The hosts connect root access on a FortiSIEM appliance with telemetry, detection data, and a possible starting point for further attacks. 15. The FortiSIEM disclosure reportedly took 150 days to resolve, and the hosts advise updating affected appliances. 16. Varonis’s re-prompt research showed that Copilot’s initial web-request protections could fail when the model was instructed to repeat a function call. 17. The Copilot technique could send a victim’s username to an attacker-controlled server and potentially expose timestamps, locations, or other conversation data. 18. Martha Liberty and Corey discuss phishing links, prompt injection, multi-factor authentication, secure coding, and the speed of AI development. 19. Security teams tracking VPN phishing, FortiSIEM flaws, and Copilot abuse. 20. Listeners seeking entertainment unrelated to enterprise security operations.

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from The 443 - Security Simplified