A new and highly sophisticated phishing campaign is targeting remote workers and IT administrators, impersonating the official Fortinet VPN download portal.
See also: Hacker group compromises multiple FortiWeb devices
The attack is considered extremely dangerous, as it exploits search engine optimization (SEO) techniques and, worryingly, search summaries generated by artificial intelligence, with the aim of luring victims.
The campaign uses a multi-stage redirect mechanism, which starts from trusted domains to bypass initial security filters, and ends with the interception of VPN credentials and the distribution of malware.
The security researcher with the pseudonym G0njxa noticed that modern search engines, which now display "quick answers" or summaries powered by AI, are unwittingly reinforcing this particular campaign.
See also: Fortinet administrators urged to update software to close FortiCloud SSO vulnerabilities
When users search for “How to download Fortinet VPN,” some AI summaries pull content from the attackers’ malicious GitHub repository (vpn-fortinet[.]github[.]io) and present it as a legitimate step-by-step guide. Because the original link is hosted on GitHub, a trusted platform, both AI models and users tend to trust it more. This “artificial” sense of trust leads users to click on the link, triggering the attack chain.
Organizations should remind their staff that legitimate software downloads rarely require credentials before even obtaining the installation file. Authenticity should always be confirmed by checking the address bar to ensure that the website belongs to the official fortinet.com.
See also: Fortinet, Ivanti and SAP patch critical vulnerabilities
At the same time, this campaign highlights a new and critical risk: there should be no blind trust in search summaries generated by artificial intelligence. Although practical, these tools draw information from the open internet and can be easily manipulated by malicious actors through simple SEO techniques. Before clicking any link, it is essential to always check the real source of the link.
🔑 Secure your passwords with Proton Pass
Password manager from Proton — end-to-end encryption, passkeys, built-in 2FA, and monitoring for leaks of your credentials.
- ✔ Encrypted storage of passwords & passkeys
- ✔ Notification if any of your passwords are leaked (Dark Web Monitoring)
- ✔ Free version — on all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
