🔴 FortiBleed 73k+ creds, 📦 Mastra supply chain, 🐘 Dropping Elephant RAT, 🇧🇷 SmartRAT ClickFix, 🐧 Showboat malware, 🔑 Kodak deadline

FortiBleed is the day's defining story and one of the largest credential exposures on record. A discovered dataset covers 73,932 FortiGate firewall URLs across 194 countries, roughly half of all internet-facing FortiGates, with credentials independently verified as authentic. The Russian-speaking operators allegedly ran about 1.16 billion credential attempts against 320,000 FortiGate targets, cracked SSL VPN hashes, and pivoted into Active Directory, fully compromising organizations including a Turkish NATO defense contractor. The FortiBleed credential leak means any organization with an exposed FortiGate should assume its VPN credentials are compromised.

The Mastra npm supply-chain attack is the second headline: attackers compromised the @mastra organization and injected the typosquatted easy-day-js dependency into 141 packages in an 88-minute window, with a postinstall hook that drops a RAT without any application import. Any host that installed those packages should be treated as compromised. Exploitation of the FortiSandbox pre-auth RCEs continues, with 49 observed events from 13 IPs across nine countries.

Dropping Elephant delivered a heavily reworked in-memory RAT through a Fondue.exe DLL side-loading chain, and Black Lotus Labs disclosed Showboat, a Linux post-exploitation framework used against Middle East telecoms since 2022 with zero AV detection until April. Red Canary documented accelerating abuse of eight legitimate RMM tools, attackers are actively exploiting the Gravity SMTP plugin, and three paid ShapedPlugin products were backdoored at the build pipeline with credential-stealing malware.

Watchlist: rotate FortiGate credentials and enforce phishing-resistant MFA, audit npm lockfiles for easy-day-js, hunt Fondue.exe side-loading, and patch or isolate Gravity SMTP installations.