FortiBleed campaign harvests credentials through FortiGate devices
SOCRadar and Hudson Rock documented FortiBleed in June 2026: an initial access broker logged in to exposed FortiGate devices with leaked or reused credentials, then ran a Go tool called FortigateSniffer to intercept authentication traffic across 24 protocols and crack the captured hashes offline, with no zero-day involved. SOCRadar tied the access to at least 12 ransomware deployments. In October 2026 the FBI and US Secret Service warned the campaign was still active and that some victims were locked out after attackers changed or deleted admin accounts.
- Victim
- Multiple: FortiGate firewall and SSL VPN operators
- Industry
- Cross-industry
- Country
- Global
- Intrusion began
- Feb 2026
- First disclosed
- Jun 22, 2026
- Actor
- Financially motivated
- Initial access
- Credential stuffing
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Edge devices accepted reused passwords for admin and VPN logins, then became a sniffer for every credential passing through. Phishing-resistant MFA on device administration and VPN, plus rotating credentials that crossed a compromised device, are the controls.
Go deeper on SWI
- Technique: Credential stuffing
- Technique: Password spraying
- SWI coverage: fortibleed campaign used custom fortigate sniffer to steal credentials
- SWI coverage: fbi and secret service warn fortibleed is still locking out victims
Sources
- FortiBleed campaign used custom FortiGate sniffer to steal credentials, BleepingComputer, Jun 22, 2026
- FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials, The Hacker News, Oct 7, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Chick-fil-A One loyalty accounts taken over by credential stuffing 2026 · Credential stuffing
- Roku account credential stuffing in two waves 2024 · Credential stuffing
- 23andMe credential stuffing and DNA Relatives data scraping 2023 · Credential stuffing
- Chick-fil-A One account credential stuffing 2023 · Credential stuffing
Cite this record
SWI Community Team. (2026). FortiBleed campaign harvests credentials through FortiGate devices. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-fortibleed-fortigate-credential-campaign/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.