Hackers Exploit GlobalProtect Flaw and Turn Stolen Data Into 2.4 Million Fraud Messages

Hackers broke into business networks, stole customer records and used those details to send convincing fake bills. The campaign, called Operation Master, combined a VPN login bypass with attacks on web applications and a large-scale invoice fraud system aimed mainly at Brazilian customers.

The activity stretched from April to mid-September 2026. Investigators found evidence of unauthorized access through seven GlobalProtect gateways in four countries, along with stolen records from at least nine database systems.

The attackers later reused customer information to make fraudulent payment requests look personal and credible. Researchers from SOCRadar identified the operation after tracing an exposed server to successive attacker-controlled systems.

SOCRadar said in a report shared with Cyber Security News (CSN) that the intrusions fed a platform capable of sending millions of messages across email and SMS.

The scale was substantial, but the financial outcome remains unclear. By September 16, the fraud panel recorded 2,468,335 emails and 1,487,294 SMS messages. Its payment records show attempted fraud, not proof that victims transferred the full amounts sought.

Hackers Exploit GlobalProtect Flaw

The attackers exploited CVE-2026-0257, a GlobalProtect authentication bypass, to create VPN sessions without valid user credentials.

They scanned hundreds of millions of addresses, filtered promising gateways and fed candidates into an automated exploit loop. Earlier coverage of GlobalProtect bypass explains the configuration conditions that make this flaw exploitable.

Recovered connection details, including assigned VPN addresses and network routes, confirmed working sessions on seven gateways. Separately, automated SQL injection attacks extracted information from at least nine systems.

On one billing server, the operator used database command execution to read records and send data out through unusually structured DNS requests.

One reconstructed theft yielded 24,558 debtor records, including contact details that could support later targeting. The attacker also harvested credential-related files and used AdaptixC2 to control at least two Windows server identities.

Readers familiar with reporting on AdaptixC2 abuse will recognize why an established remote-control framework can extend an intrusion after initial access.

Investigators linked an operator persona selling stolen energy-sector data to the later fraud setup. The same organizations appeared in listings weeks before their details were loaded into campaigns.

That sequence points to two uses for the theft: selling records first, then using them to pursue payments directly. The exposed systems also showed how quickly stolen business records could move from network intrusion to tailored messages delivered to ordinary customers at scale.

Fake Bills at Industrial Scale

The attackers built a shared fraud panel that could change its branding and message templates for different impersonated utility providers.

It used roughly 12 hijacked Microsoft 365 mailboxes for email and eight messaging gateways for SMS. WhatsApp templates also carried links to fraudulent invoice documents.

The panel generated 622,666 personalized short links and logged 317,696 click events by September 14. Some payment pages displayed genuine customer details and mirrored real invoice documents, making the demands harder to dismiss.

Logged invoice values totaled R$150.4 million, while clicked invoices represented R$38.9 million in exposure; neither figure establishes money received.

Investigators also found Microsoft 365 device-code phishing and phone-based attempts to obtain verification codes. These methods differ from a fake-bill link because a victim can approve access through a real sign-in page or during a call.

Separate reports on device-code phishing illustrate why familiar login screens do not guarantee a request is safe. Companies affected by stolen records should also warn customers about convincing impersonation.

Defenders should patch exposed remote-access devices, check whether authentication override is needed and inspect unusual VPN sessions.

SOCRadar also recommends limiting database command execution, monitoring suspicious DNS traffic and unexpected cloud-sync activity, and reviewing device-code approvals and bulk mail from institutional accounts.

For consumers, an unexpected bill should be checked through a trusted account or previously known contact channel before making an instant payment.

The exposed infrastructure went offline in mid-September, but investigators could not establish whether the wider operation stopped or moved elsewhere across multiple regions.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC