Hackers Using FortigateSniffer Tool That Turns Compromised Firewalls Into Password Collectors

A financially motivated threat actor has deployed a custom Golang-based tool called FortigateSniffer across more than 430,000 FortiGate firewalls globally, silently harvesting over 110 million credentials since at least February 2026, including confirmed data exfiltration from a NATO-aligned defense contractor. The campaign, dubbed FortiBleed and investigated by SOCRadar’s Threat Research Unit (STRU), represents one of […]

The post .