FortiBleed's 110-Million-Credential Heist, a Video File That Hacks Servers, and a 29-Year-Old Bug
Wednesday, June 24, 2026 · 5-minute read
A financially motivated Russian-speaking group ran a sweeping credential harvest called FortiBleed against over 430,000 FortiGate firewall devices worldwide since February 2026. The operation deployed a custom tool called FortigateSniffer — which hijacks a built-in FortiOS diagnostic command to silently eavesdrop on authentication traffic — and collected over 110 million credentials. The US and India were the primary targets, with IT service providers singled out because compromising them opens doors into all of their clients. A dark web account was spotted selling access to thousands of the breached devices for up to $60,000.
↗ The Hacker NewsPresident Trump signed EO 14409 on June 22, requiring federal agencies to migrate high-value systems to post-quantum cryptography by December 31, 2030, with digital signatures following by 2031. The order directly addresses the "harvest now, decrypt later" threat — where adversaries collect encrypted government data today, planning to decrypt it once quantum computers become powerful enough. The deadline is four to five years earlier than the previous government target of 2035 and aligns with the NIST encryption standards finalized in 2024.
↗ The Hacker NewsThe Texas Parks and Wildlife Department disclosed that a security incident at its license system vendor exposed personal information for more than three million individuals. The breach hit the vendor's systems — not TPWD directly — but the impact falls on residents who used the state's licensing portal. Exposed data includes driver's license numbers along with the personal details typically required for outdoor recreation permits. Affected individuals should monitor their credit and be alert to identity theft attempts using their license details.
↗ BleepingComputerKaspersky is tracking an active phishing campaign that sends fake business and financial documents via WhatsApp direct messages. When opened, the files — disguised as invoices or contracts — execute a malware chain that installs legitimate Remote Monitoring and Management (RMM) software, giving the attacker full remote control of the victim's computer. The campaign is hitting users in Malaysia (hardest hit), Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, and Vietnam. Because the final payload is a real commercial tool, many security scanners don't flag it.
↗ The Hacker NewsA remote code execution bug in FFmpeg's MagicYUV video decoder — dubbed PixelSmash by researchers at JFrog — can be triggered simply by adding a crafted video file to a media library. On Jellyfin servers, the server automatically scans new files, which fires the flaw without any user interaction. Researchers achieved full remote code execution on a default Jellyfin installation. The same flaw causes crashes (denial-of-service) on Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio. Slack, Discord, and Telegram may also be affected through server-side video preview generation.
✅ Patch available. Update FFmpeg to version 8.1.2 (released June 17). Jellyfin has already updated its bundled FFmpeg. PhotoPrism is working on a blocklist fix.
An out-of-bounds memory access flaw in Chrome's V8 JavaScript engine is being actively exploited in the wild. Visiting a crafted webpage is enough for an attacker to run arbitrary code inside Chrome's browser environment. This is the fifth Chrome zero-day exploited this year. All Chromium-based browsers — including Edge, Brave, Opera, and Vivaldi — are affected until updated.
✅ Patch available and urgent. Update Chrome to version 149.0.7827.103 immediately. Go to Chrome Menu → Help → About Google Chrome, then click Relaunch.
A bug in Squid's FTP directory parser — introduced in 1997 and never caught — lets any authorized user of a shared proxy steal another user's cleartext HTTP requests, including login credentials and session tokens. The attacker just needs to be on the same network and have proxy access — making this dangerous in schools, offices, and public Wi-Fi environments. A proof-of-concept exploit is publicly available, though no attacks have been reported yet.
⚠️ Patch available in Squid 7.7. If you can't update immediately, the simplest fix is disabling FTP access on your proxy — most networks don't need it, and disabling it eliminates this attack vector entirely.
OpenAI this week released GPT-5.5-Cyber — its most powerful security-focused AI model yet — to trusted defenders as part of its Daybreak initiative. The model can scan large codebases, find security flaws, trace attack paths, and generate patches ready for human review. Alongside this, OpenAI launched Patch the Planet in partnership with security firm Trail of Bits, targeting major open-source projects including Python, cURL, Go, and Mozilla Firefox. The initiative is a direct response to a new reality: AI is now finding software bugs faster than humans can fix them, and the bottleneck has shifted from discovery to patching. GPT-5.5-Cyber is available to vetted security researchers and defenders — not the general public — with human oversight built into the workflow.
Imagine a factory that runs around the clock, its shifts beginning precisely at 7 a.m. Moscow time. Workers aren't assembling products — they're harvesting passwords. By the end of each five-hour cycle, the operation has validated tens of thousands of stolen credentials and is already loading the next batch of targets. That factory is FortiBleed, and it quietly operated inside corporate networks for four months before researchers noticed.
FortiBleed is the name security firm SOCRadar gave to a large-scale credential-theft operation run by a Russian-speaking group since February 2026. The targets: over 430,000 FortiGate firewalls — the expensive security appliances that companies trust to guard the front door of their networks. The irony is dark. The device you buy to protect your network became the device broadcasting your passwords to strangers.
The operation moves in five stages. First, automated scanning tools sweep the internet for exposed FortiGate devices. Second, custom tools try stolen and default passwords against admin login panels — a technique called brute force combined with credential stuffing. Once inside, the attackers deploy FortigateSniffer — a bespoke tool written in Golang that doesn't look like malware at all. It uses a diagnostic command built directly into FortiOS, the firewall's own operating system, to listen to all traffic passing through the device.
Think of it like this: every corporate network uses its firewall as a checkpoint. Employees connecting through a VPN, authenticating to internal systems, logging into servers — all of that traffic flows through the firewall. FortigateSniffer sits there and reads the mail. Usernames, passwords, session tokens, authentication hashes across 24 different protocols: all captured, logged, and shipped off for cracking. The stolen password hashes are then sent to a distributed cracking cluster managed by a Telegram bot called HASHBOT, which runs billions of guesses per second until readable passwords emerge.
What the group does next is methodical. Targets are ranked by economic value. IT service providers sit at the top of the priority list, because breaking into a managed service provider means getting keys to every business that company supports. From there, the attackers use the cracked credentials for lateral movement — spreading deeper into victim networks, accessing file shares, and exfiltrating data.
The scale is staggering: over 110 million credentials identified across 659 harvesting pipelines. A dark web account called "SantaAd" advertised access to thousands of breached Fortinet devices starting at $30,000, spiking to $60,000 within hours.
The most alarming part isn't the numbers — it's the professionalism. FortiBleed isn't a ragtag group running scripts. It's an industrialized operation with shift schedules, business logic, and priority queues. Small businesses with under 200 employees are the primary targets, precisely because they're less likely to notice. If your organization uses FortiGate devices, audit your VPN logs for unusual authentication activity, rotate all credentials that may have passed through your firewall, and ensure your FortiOS firmware is current.