#5
The Hacker News
general
May 28, 2026 at 15:26 UTC
Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer
By [email protected] (The Hacker News)
AI Summary
Threat actors are actively exploiting a critical patched vulnerability in Fortinet's FortiClient Endpoint Management Server (EMS) to deploy credential-stealing malware disguised as a Fortinet endpoint agent. Arctic Wolf's research shows attackers abused trusted endpoint management infrastructure to propagate the stealer across all managed endpoints, amplifying the blast radius beyond the initial compromise.
Relevance score: 80.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →