Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)

A significant campaign, dubbed “TheHatman” and “FortiBleed,” is targeting organizations with leaked credentials, primarily leveraging password spraying against Fortinet and Sophos devices. TheHatman, an actor offering stolen credentials, has been active since August 1st, 2026, and has claimed to exfiltrate sensitive da…