FortiBleed: Massive Credential Harvesting Hits Tens of Thousands of Fortinet Devices
In mid-June 2026, researchers uncovered “FortiBleed,” a large-scale credential compromise campaign targeting internet-exposed Fortinet FortiGate firewalls and VPN gateways. Security researcher Volodymyr “Bob” Diachenko and teams from SOCRadar and Hudson Rock identified an exposed attacker directory containing verified credentials for approximately 73,000–86,000 devices across nearly 200 countries—roughly half of all publicly accessible Fortinet devices.
Attackers appear to have scanned for exposed management interfaces, extracted configuration data or hashes (possibly from prior compromises), and cracked them offline using significant resources. Affected organizations include high-profile entities, with risks of further data theft, lateral movement, or ransomware deployment. CISA issued urgent guidance urging credential rotation, MFA enablement, management interface hardening, and use of lookup tools from Hudson Rock/SOCRadar.
Key Takeaways and Advice: This incident underscores the dangers of exposed admin interfaces and unrotated credentials. Immediately audit Fortinet devices, restrict public access, rotate all credentials, and monitor for IOCs. Organizations should treat this as an active threat.
Steam Workshop Abused for Malware Delivery via Wallpaper Engine
Kaspersky researchers revealed that threat actors have been distributing malware through Steam Workshop submissions for the popular Wallpaper Engine app (nearly 20 million users/downloads). Since at least late 2025, dozens of malicious “Application”-type wallpapers—often anime-themed and targeting certain regions—have been uploaded. These packages contain hidden executables that can steal Steam accounts, install backdoors (e.g., DarkComet), deploy infostealers (targeting crypto wallets), run cryptominers, or worse.
The wallpapers exploit user trust in the Workshop sharing feature. Infected items gained thousands of downloads before removal. Valve has taken down the malicious content, but previously subscribed users remain at risk.
Key Takeaways and Advice: Avoid “Application” type wallpapers in Wallpaper Engine. Filter and review subscriptions, scan systems with updated antivirus, enable Steam 2FA, and monitor accounts. This highlights risks in community content platforms—stick to video/image wallpapers where possible.
Record-Breaking Microsoft June 2026 Patch Tuesday
Microsoft’s June 2026 Patch Tuesday addressed a record ~198–208 CVEs (numbers vary slightly by source), including dozens of critical vulnerabilities, multiple zero-days (some actively exploited or publicly disclosed), and fixes across Windows, Exchange, Office, Hyper-V, and more. This shatters previous records and reflects the growing volume of reported issues, partly driven by AI-assisted discovery.
Notable areas include kernel flaws, authentication bypasses, and remote code execution risks. Prompt patching is critical, especially for internet-facing systems.
Key Takeaways and Advice: Prioritize deployment of these updates, test in staged environments if possible, and monitor for post-patch issues. This release emphasizes the need for robust patch management in an era of accelerating vulnerability disclosure.
These stories illustrate ongoing trends: perimeter device exposure, supply-chain/community trust abuse, and the relentless pace of vulnerability management. Stay vigilant, patch promptly, and layer defenses.