The FortiBleed Campaign and Why It Matters
According to a report covered by The Hacker News, a large-scale credential-harvesting operation called FortiBleed has been targeting FortiGate firewalls around the world since early 2026. This campaign is not just another data breach story — it shows how attackers are now using firewalls themselves as tools to steal login details on a massive scale.
What makes this significant is the sheer volume: more than 110 million credentials were collected, including passwords for remote access, email, and databases. The attackers didn't just break into one system; they built automated pipelines that scanned the internet for vulnerable firewalls, broke in, and then used those devices to spy on traffic passing through them. For any business that relies on a FortiGate firewall, this is a wake-up call.
Why the Attackers' Methods Are So Concerning
The most troubling part of this operation is how the attackers used a simple trick. They took advantage of a built-in diagnostic command on FortiOS — a feature meant for network troubleshooting — to silently capture login credentials as they crossed the firewall. This is not a complex exploit; it's a misuse of a legitimate tool, which makes it harder to detect.
Further, the group behind FortiBleed targeted small and medium businesses with fewer than 200 employees. They focused heavily on the IT services sector, likely because compromising one service provider can give them access to many customer networks. This means Australian MSPs and SMBs that use FortiGate devices are directly in the crosshairs. The attackers also ranked targets by economic value, so a business with valuable data or client access is a prime candidate.