Fake Fortinet VPN Sites Stealing Credentials: What Remote Workers Need to Know
You’re Being Targeted – Here’s How to Protect Yourself
If you work remotely and use Fortinet VPN to access your company network, there’s something you need to know: hackers are creating fake Fortinet websites to steal your login details. And they’re doing it in a way that’s surprisingly clever.[1]
A new phishing attack is making the rounds right now, targeting remote workers and IT teams by posing as the official Fortinet VPN download page. The goal? Steal your VPN username and password, then use those credentials to break into your company’s systems. What makes this attack particularly worrying is that it’s using artificial intelligence and search engine tricks to look completely legitimate.[1][2]
How Are Hackers Getting People to Click?
Here’s the sneaky part: when you search Google for “how to download Fortinet VPN,” the fake Fortinet phishing page can show up in your results. Even worse, if your search engine uses AI to show you quick answers, it might pull instructions directly from the attacker’s fake website and present it as a helpful guide.[1][2]
The attacker uses a tool called GitHub Pages, which is a totally legitimate platform trusted by software developers, to host a fake “how-to guide” for downloading Fortinet. Because GitHub is so trustworthy, both Google’s AI and regular people are way more likely to click on it.[1][2]
This is a big deal because it means hackers aren’t just relying on social engineering emails anymore. They’re manipulating Google and other search engines to advertise their malicious websites for them.
The Attack Breaks Down Into 4 Sneaky Stages
Stage 1: The Fake “Quick Answer”
You search for “how to download Fortinet VPN” and Google’s AI shows you what looks like a helpful step-by-step guide. Except it’s not helpful, it’s a trap.[1][2]
The attacker has posted the fake guide on vpn-fortinet[.]github[.]io, making it look legit by hosting it on GitHub, a platform trusted by millions of developers worldwide.
Stage 2: The Invisible Redirect
You click the link thinking you’re going to be a helpful guide. What happens is the website checks where you came from. If it detects you arrived from Google, Bing, or Yahoo, it silently redirects you to fortinet-vpn[.]com, the attacker’s fake Fortinet login page.[1][2]
Here’s the clever part: if a security robot or researcher tries to investigate the original link, the redirect doesn’t trigger. This helps the hackers keep their fake site hidden from security teams and automated detection tools.[1][2]
Stage 3: They Steal Your Credentials
The fake fortinet-vpn[.]com website looks almost identical to the real Fortinet page. It asks you to enter three things:
- Remote Gateway
- Your username
- Your password [1][2]
You enter your details because you genuinely believe you’re on the real Fortinet website. The moment you hit submit, those credentials get sent straight to the attackers’ servers.
Stage 4: The Perfect Disguise
After you’ve entered your login info, the fake site sends you a download of what appears to be the real FortiClient VPN software. It’s actually legitimate software, so you install it and never suspect anything went wrong.[1][2]
But your credentials are already compromised. The hackers now have access to your login information, and there’s nothing to warn you that something bad just happened.
Which Domains Should You Block?
If you work in IT or security, here’s what you need to watch for. Block these domains immediately and check your firewall logs to see if anyone in your company has tried to access them:[1][2]
What to Watch For | The Domain | Why It’s Bad |
Redirect page | vpn-fortinet[.]github[.]io | This is the fake “guide” hosted on GitHub that starts the whole attack |
Phishing site | fortinet-vpn[.]com | This is where your credentials get stolen |
Download host | myfiles2[.]download | This delivers the software (sometimes legitimate, sometimes malware) |
Why This Attack Is Particularly Dangerous
Hackers Are Now Gaming Artificial Intelligence
Here’s what’s scary about this attack: threat actors aren’t just tricking humans anymore. They’re exploiting the infrastructure of AI-powered search engines.[1][2]
They’ve figured out that if they put malicious content on a reputable website like GitHub and optimize it a bit, Google’s AI will pick it up and display it as a helpful search result. Thousands of people see what looks like a trustworthy source, click it, and get compromised.
Multiple Layers of Deception
This attack uses several tricks at once to avoid getting caught:[1][2]
Uses a trusted platform first: GitHub is so reputable that domain filtering systems don’t flag it as dangerous.
- Hides from security scanners: The selective redirect only triggers when someone comes from a real search engine, not from automated security tests.
- Looks exactly like the real thing: The fake Fortinet site is a pixel-perfect copy, so even careful users can be fooled.
How to Protect Yourself and Your Team
1. Download From Official Sources Only
- Only download Fortinet VPN software from com or your company’s internal software portal.[1][2]
- If you’re looking for a download link and it takes you to anywhere other than com, stop and contact your IT team.
- Here’s a red flag: legitimate software companies almost never ask you to enter your password just to download their software.[1][2]
2. Lock Down Your VPN Accounts
- Use multi-factor authentication (MFA) on your VPN account if your company offers it. This means even if a hacker has your password, they can’t get in without your phone or security key.[1]
- Watch for unusual login attempts: If your IT team mentions they see logins from strange locations or at weird times on your account, take it seriously.
- Change your password immediately if you think you might have entered your credentials on a fake website.
3. Keep Your Eyes Open (Security Awareness)
- This attack is actively happening right now, so security isn’t optional anymore.
- When downloading security software, always pause and double-check the URL in your browser’s address bar.
- If something feels off, even a little bit, ask your IT team before clicking or downloading anything.
- Remember the simple rule: Never enter your login credentials just to download software.
4. For IT Teams: Block and Monitor
- Add these three domains to your firewall and web filter block lists: vpn-fortinet[.]github[.]io, fortinet-vpn[.]com, and myfiles2[.]download.[1][2]
- Check your DNS and proxy logs to see if anyone in your company has tried to visit these sites.
- Set up alerts so you get notified immediately if anyone tries to access them.
- Configure your email security system to flag messages with links to these domains.
The Bottom Line
The threat landscape is changing. Hackers aren’t just sending phishing emails anymore; they’re manipulating search engines and AI tools to make their fake websites look legitimate.[1][2]
The good news? The defense is straightforward:
Be skeptical when downloading security software
Check the URL in your browser’s address bar
Use multi-factor authentication on VPN accounts
Ask your IT team when in doubt
For remote workers and organisations in Mauritius and across the region, where secure VPN access has become essential for business continuity, staying alert to threats like this isn’t just good practice, it’s critical to keeping your business safe.
References
[1] Cybersecurity News. (2026, January 8). Fake Fortinet Sites Steal VPN Credentials in Sophisticated Phishing Attack. Retrieved from https://cybersecuritynews.com/fake-fortinet-sites/
[2] CodeKeeper. (2026, January 9). Fake Fortinet VPN Phishing Threat. Retrieved from https://codekeeper.co/ticker/fake-fortinet-vpn-phishing-threat
[3] Darktrace. (2026, January 12). From Exploit to Escalation: Tracking and Containing a Real-World Fortinet SSL-VPN Attack. Retrieved from https://www.darktrace.com/blog/from-exploit-to-escalation-tracking-and-containing-a-real-world-fortinet-ssl-vpn-attack
16 January 2026
Husseyne Karroo
Digital & Communication Manager
