Threat Brief: Mitigating Large-Scale Credential Attacks (Updated Aug. 18)
A threat actor known as "TheHatman" advertised employee information from several high-profile organisations on underground forums between August 1 and August 17, 2026, according to Palo Alto Networks Unit 42.
Source: Palo Alto Unit 42 · August 18, 2026 at 10:01 PM · AI-assisted report
Single-sourceKUALA LUMPUR, 19 AUGUST 2026 —
Listen to this article
DomainFork Audio · read aloud
A threat actor known as "TheHatman" advertised employee information from several high-profile organisations on underground forums between August 1 and August 17, 2026, according to Palo Alto Networks Unit 42.
Market Impact
Unit 42 said it could not verify the intrusion method claimed by TheHatman, who alleged the data was obtained via compromised credentials and MFA fatigue attacks. Public reporting of the activity surfaced on August 16, 2026, and Unit 42 issued initial guidance the same day. The actor has not provided proof of access, and Unit 42 has not confirmed the claims.
The campaign follows a password-spraying assault codenamed FortiBleed disclosed in June 2026. Unit 42 said attackers compiled curated password lists using credentials from prior breaches and vulnerability exploitation, then used those lists against exposed services. The group targeted Fortinet and MSSQL devices and, in separate reports, Sophos devices. Palo Alto Networks said it has blocked suspicious login attempts in customer telemetry, but its own products were not directly targeted.
An initial access broker on the Russian-language forum Exploit[.]in claimed responsibility on June 16, 2026, citing a CVE, though Unit 42 has not validated the claim. SOCRadar first reported targeting of FortiGate devices in June.
Unit 42 recommends auditing remote-access logs for successful logins following high-volume password failures and reviewing hardening guidance for edge devices. Organisations can also request proactive assessments or incident-response assistance from the Unit 42 team.
Malaysian businesses using cloud services or remote access should review identity security posture immediately. Unit 42’s Deep and Dark Web monitoring can detect leaked credentials, while Cortex Cloud Identity Security offers cloud infrastructure entitlement management, identity security posture management, data access governance and identity threat detection and response. Idira Identity Threat Protection, Idira Multi-Factor Authentication and Idira Privileged Access Management provide near real-time detection, phishing-resistant MFA and automated credential rotation to counter spraying and theft.
Related: Microsoft