Attackers executed a phishing campaign against ReTool, a third-party vendor providing portal access for Fortress Trust customers to manage cryptocurrency custody. The compromise leaked Fortress operator credentials, allowing attackers to initiate unauthorized fund transfers from customer accounts.