FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation

A cluster of high-impact cyber incidents and security updates: a large-scale credential-harvesting campaign dubbed “FortiBleed” (Russian-speaking IAB) has targeted hundreds of thousands of internet-exposed FortiGate appliances and amassed millions of credentials, prompting CISA warnings and active exploitation. Multiple supply-chain and distribution attacks were reported — backdoored ShapedPlugin WordPress Pro releases, malicious npm packages delivering a Windows RAT, and a new OXLOADER/Google‑Ads campaign dropping CastleStealer. Notable vulnerabilities and exploit disclosures include Squidble