Operation Master: Hackers Use VPN Flaw to Fuel Massive Invoice Scam

Security researchers have traced a coordinated intrusion campaign that leveraged a vulnerability in Palo Alto Networks' GlobalProtect VPN client to infiltrate corporate networks and harvest customer data. The attackers, dubbed Operation Master, combined the VPN bypass with web‑application exploits to amass personal and financial details, which were then repurposed for a large‑scale invoice fraud operation targeting businesses, especially in Brazil.

The breach began with the exploitation of a login bypass in GlobalProtect, allowing threat actors to gain persistent access to internal systems without valid credentials. Once inside, the group deployed custom scripts to scan for databases, CRM platforms, and billing portals, extracting names, addresses, account numbers, and transaction histories. The stolen information formed the backbone of a sophisticated phishing campaign that sent out more than two million counterfeit invoices to unsuspecting recipients.

Victims reported receiving seemingly legitimate bills that mirrored the formatting and language of genuine vendor communications. Because the messages incorporated real customer identifiers, many recipients processed the payments before realizing the fraud. Early estimates suggest the operation generated tens of millions of dollars in fraudulent transfers before law enforcement intervened.

Cybersecurity experts note that the convergence of a VPN flaw with downstream web‑application attacks illustrates a growing trend where attackers chain multiple vulnerabilities to maximize impact. The focus on Brazilian companies aligns with recent intelligence indicating that the region’s high volume of cross‑border trade and reliance on electronic invoicing make it an attractive target for invoice‑fraud schemes.

Authorities in Brazil and the United States have opened joint investigations, and the affected organizations are urged to review VPN configurations, enforce multi‑factor authentication, and conduct thorough audits of their invoicing workflows. The incident underscores the importance of a layered defense strategy that can detect anomalous activity even when a single security control is compromised.