MexicanMafia FortiGate Cleartext VPN Credential File Access

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

This rule detects activities related to Operation Escaneo, specifically focusing on the creation, modification, or access to cleartext credential harvesting files (e.g., vpn-passwords.txt) and the execution of associated Python scripts (forti_login2.py, forti_login3.py) used for credential staging and extraction on FortiGate systems.