It gathered credentials from two victims that they then attempted to validate across 75 different websites. It has also collected credentials from over 900 Fortinet VPN servers in the US, Europe, and Israel.