AI Summary

Hackers are using an authentication bypass flaw (CVE‑2026‑35616) in FortiClient Enterprise Management Server to push a credential‑stealing malware called EKZ. The attackers disguise the malware as a legitimate Fortinet endpoint update. They deliver it through VPN scripting workflows that are managed by FortiClient. The vulnerability allows the malware to run without proper authentication, enabling the theft of user credentials. The attack demonstrates how a single server flaw can be leveraged to compromise endpoint security.

AI summaries can be wrong sometimes—always verify important details using the source article.