FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist

Researchers uncovered the FortiBleed campaign in which attackers deploy a Golang sniffer (FortigateSniffer) on Internet-exposed FortiGate firewalls to passively capture credentials across ~24 authentication protocols. The campaign has created hundreds of credential-harvesting pipelines, impacted a global set of devices (reportedly targeting >430,000 FortiGate instances), and resulted in the theft of over 110 million credentials; attackers then crack and reuse those credentials for AD/SMB access, lateral movement, data theft and downstream ransomware or resale.