FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials

The FBI and Secret Service (USSS) have issued a joint warning that the FortiBleed credential harvesting campaign remains actively targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The campaign exploits reused or leaked credentials combined with legacy SHA-256 password storage vulnerabilities to compromise devices. Over 86,644 Fortinet device credentials have been amassed by threat actors through this ongoing campaign. The advisory highlights the risks posed by poor credential hygiene and outdated password hashing mechanisms in widely deployed network security appliances. Organizations using Fortinet FortiGate devices are urged to rotate credentials, upgrade firmware, and review authentication configurations immediately.