Enterprise VPN portals remain one of the most reliable initial-access surfaces on the public internet—not because the protocols are broken, but because stolen or guessed passwords still work at scale. This piece is threat research synthesis, not a vendor release note: it connects Verizon’s 2025 DBIR credential-stuffing measurements with a February 2026 coordinated campaign against Palo Alto GlobalProtect portals, and explains what that pattern means for operators and privacy-conscious remote workers.
What the numbers say about credential stuffing
Verizon’s additional 2025 DBIR research on credential stuffing reports that compromised credentials were an initial access vector in 22% of reviewed breaches. In SSO provider logs, the median daily share of authentication attempts attributed to credential stuffing was 19%—about 25% for enterprise-sized customers and 12% even for small businesses—with a single-day peak of 44%. Infostealer malware data in the same write-up showed that, in the median case, only 49% of a user’s saved passwords across services were distinct. In plain language: reuse is still common enough that combo lists remain profitable.
Source: Verizon Business — Additional 2025 DBIR research on credential stuffing.
Credential stuffing differs from loud password spraying. Attackers feed previously breached username/password pairs (combo lists), often through proxies, and try each pair once per target so the traffic blends into ordinary login noise. MFA reduces the blast radius, but Verizon notes MFA is increasingly table stakes rather than a silver bullet—especially when users are never enrolled, or when session tokens are stolen after a successful login.
Case study: GlobalProtect portals, February 2026
On 23–24 February 2026, ELLIO Threat Research Lab observed an 11× spike against Palo Alto GlobalProtect login paths (/global-protect/login.esp). Across roughly 48 hours, sensors recorded about 30,000 sessions from 8,575 unique source IPs in three orchestrated waves. About 89% of sessions were GET reconnaissance; a subset followed with POST login attempts.
The POSTs reused a single password (Password1) across a fixed dictionary of 78 employee-style usernames (first initial + last name). ELLIO assessed that phase as aggressive probing of which portals accept the authentication form, not necessarily a carefully curated combo-list smash. Infrastructure was concentrated in GTT Communications (AS3257) address space, with distinctive TCP/HTTP fingerprints (including a JA4H POST fingerprint nearly exclusive to the campaign).
Source: ELLIO — Coordinated Credential-Stuffing Campaign Targets Palo Alto GlobalProtect Portals (26 February 2026).
The defensive lesson ELLIO emphasizes is sequencing: GET probing preceded POST stuffing by hours inside each wave. Organizations that blocked reconnaissance IPs or tool fingerprints early never saw the credential phase. VPN portals remain recurring targets; hosting ASNs rotate, but the playbook—find the portal, test auth, move on—does not.
How this differs from a single-vendor “bleed” headline
Mass credential exposures against specific firewall VPN brands dominate news cycles because the counts are huge and the IOCs are concrete. Those incidents matter. They are not, however, the only shape of the problem. The GlobalProtect wave shows a lower-and-slower pattern: commodity username lists, trivial passwords, and wide scanning of internet-facing SSL VPN login pages. Verizon’s SSO telemetry shows the same class of abuse consuming a large fraction of daily authentication traffic across many industries—not only firewall appliances.
For a privacy and security audience, the shared root causes are boring and durable:
- Password reuse across corporate SSO, VPN, email, and personal sites.
- Internet-exposed VPN or admin portals that accept password auth without phishing-resistant MFA.
- Weak or legacy password storage on appliances (where offline cracking becomes practical after hash theft).
- Infostealer malware on endpoints that harvests browser-saved VPN and admin credentials into underground markets.
Risk to people, not only to SOC dashboards
When a corporate SSL VPN account is stuffed successfully, the attacker inherits a trusted path into internal apps, mail, and file shares. That can become ransomware staging, payroll fraud, or quiet data theft. For individuals using consumer VPNs, the analogous failure mode is account takeover of the VPN subscription itself (billing email + reused password), followed by session abuse or support-channel social engineering. The cryptography of WireGuard or OpenVPN does not help if the attacker simply logs in as you.
Remote workers should also remember that a company VPN portal on the public internet is an advertisement: scanners will find /global-protect/login.esp, Fortinet SSL VPN paths, and similar URLs continuously. “We are too small to target” is inconsistent with Verizon’s small-business stuffing rate and with automated campaigns that cost almost nothing per try.
Grounded mitigations (operators)
- Remove public admin where possible. Management interfaces should not face the whole internet; prefer allowlisted jump hosts or zero-trust brokers.
- Enforce phishing-resistant MFA on VPN and admin accounts (FIDO2/passkeys or equivalent), not SMS alone.
- Block recon early. Feed high-confidence scanner fingerprints and ASNs into edge controls before POST stuffing starts.
- Rate-limit and alert on distributed auth failures against VPN paths; watch for uniform passwords or rigid username patterns.
- Rotate credentials after infostealer hits on admin laptops; assume browser-saved VPN passwords were copied.
- Prefer stronger password hashing on appliances (for example PBKDF2 where vendors support it) and disable legacy hash modes.
- Follow vendor and national CSIRT guidance when a campaign names your product family; verify configuration baselines for unknown admin accounts.
Grounded mitigations (individuals)
- Use a password manager; never reuse your VPN or email password elsewhere.
- Turn on MFA for the VPN account and the email inbox that can reset it.
- Avoid saving corporate VPN passwords in browsers on personal devices that also run random extensions.
- Treat unexpected VPN password-reset mail as a potential incident, not routine noise.
What we are not claiming
This article does not claim that GlobalProtect is uniquely weak, that every organization seeing scans is already breached, or that consumer no-logs VPNs are immune to account takeover. It does claim—based on Verizon’s published measurements and ELLIO’s February 2026 campaign telemetry—that credential stuffing against VPN authentication endpoints is routine, automated, and still effective wherever passwords remain the gate.
Strong tunnels matter. So do unique passwords, MFA, and shrinking the number of password gates you expose to the entire internet.