Executive Summary
Identity has effectively become the new perimeter, where cybercriminals are increasingly choosing to log in rather than break in. To accomplish this, attackers frequently gather previously leaked username and password pairs. Gathering these credentials can then allow them to pivot to password spraying against services exposed to the internet, gaining credentials for other products and services.
As this sort of attack occurs frequently, this article will be a resource repository of the following information about these attacks:
- Details of noteworthy large scale credential attacks
- Actionable guidance for mitigating these attacks
TheHatman Attack
- The Hatman attack: In August 2026, the actor TheHatman claimed to have stolen large volume of credentials from organizations' Microsoft Entra tenants
FortiBleed Attack
- Fortibleed Credential Campaign: In June 2026, there was a large-scale password spraying campaign targeting Fortinet devices
Unit 42 recommends auditing remote access logs for suspicious activity with a focus on successful logins shortly after large volume password failure events. We also recommend reviewing and implementing the hardening guidance in this article for edge devices.
Palo Alto Networks customers are better protected from this activity through our products and services, such as:
- Cortex Cloud Identity Security
- Unit 42 Deep and Dark Web Service
- Idira Identity Threat Protection (ITP)
- Idira Multi-Factor Authentication (MFA)
- Idira Privileged Access Management (PAM)
The Unit 42 Incident Response team can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk.
| Related Unit 42 Topics | Fortibleed, Credential Theft |