--- title: Arctic Wolf Observes Malicious Configuration Changes On... description: Arctic Wolf detected a new automated attack campaign targeting Fortinet FortiGate devices starting January 15, 2026. Attackers exploited SSO accounts to make... canonical: https://daily.dev/posts/arctic-wolf-observes-malicious-configuration-changes-on-fortinet-fortigate-devices-via-sso-accounts-r9rchemnx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Arctic Wolf Observes Malicious Configuration Changes On Fortinet FortiGate Devices via SSO Accounts | daily.dev og:description: Arctic Wolf detected a new automated attack campaign targeting Fortinet FortiGate devices starting January 15, 2026. Attackers exploited SSO accounts to make... og:url: https://daily.dev/posts/arctic-wolf-observes-malicious-configuration-changes-on-fortinet-fortigate-devices-via-sso-accounts-r9rchemnx og:image: https://api.daily.dev/og/posts/R9RchEmNx.png og:image:alt: Arctic Wolf Observes Malicious Configuration Changes On Fortinet FortiGate Devices via SSO Accounts og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Arctic Wolf Observes Malicious Configuration Changes On Fortinet FortiGate Devices via SSO Accounts **[Arctic Wolf](https://daily.dev/sources/arcticwolf)** · 4 min read · 0 upvotes · 0 comments ## Summary Arctic Wolf detected a new automated attack campaign targeting Fortinet FortiGate devices starting January 15, 2026. Attackers exploited SSO accounts to make unauthorized firewall configuration changes, create persistence accounts, grant VPN access, and exfiltrate configurations. The activity resembles a previous December 2025 campaign involving SSO authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719). Malicious logins originated from specific hosting providers, targeted the cloud-init@mail.io account, and executed within seconds suggesting automation. Recommendations include monitoring Fortinet updates, resetting credentials if affected, restricting management interface access, and potentially disabling FortiCloud SSO as a workaround. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Fortinet SSO patch bypass gets a separate critical CVE](https://daily.dev/posts/fortinet-sso-patch-bypass-gets-a-separate-critical-cve-pbbljiqf4) · The Register · 0 upvotes · 0 comments - [CVE-2025-32975](https://daily.dev/posts/cve-2025-32975-4tolc5nip) · Arctic Wolf · 0 upvotes · 0 comments - [FortiBleed Attackers Turn Firewalls Into Credentials Stealers](https://daily.dev/posts/fortibleed-attackers-turn-firewalls-into-credentials-stealers-tlixwikrz) · Dark Reading · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#authentication](https://daily.dev/tags/authentication), [#vulnerability](https://daily.dev/tags/vulnerability), [#fortinet](https://daily.dev/tags/fortinet) [View this post on daily.dev](https://daily.dev/posts/arctic-wolf-observes-malicious-configuration-changes-on-fortinet-fortigate-devices-via-sso-accounts-r9rchemnx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Arctic Wolf Observes Malicious Configuration Changes On Fortinet FortiGate Devices via SSO Accounts","url":"https://daily.dev/posts/arctic-wolf-observes-malicious-configuration-changes-on-fortinet-fortigate-devices-via-sso-accounts-r9rchemnx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/arctic-wolf-observes-malicious-configuration-changes-on-fortinet-fortigate-devices-via-sso-accounts-r9rchemnx"},"datePublished":"2026-01-21T21:24:28.487Z","dateModified":"2026-03-02T23:16:12.232Z","description":"Arctic Wolf detected a new automated attack campaign targeting Fortinet FortiGate devices starting January 15, 2026. Attackers exploited SSO accounts to make...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a46f01390b4b6b493c1ec3bb3051226e?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a46f01390b4b6b493c1ec3bb3051226e?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Arctic Wolf","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Arctic Wolf","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/30920b37616d4d80ad2b810a4b9f6b2e","url":"https://daily.dev/sources/arcticwolf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/arctic-wolf-observes-malicious-configuration-changes-on-fortinet-fortigate-devices-via-sso-accounts-r9rchemnx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,authentication,vulnerability,fortinet","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Arctic Wolf","item":"https://daily.dev/sources/arcticwolf"},{"@type":"ListItem","position":3,"name":"Arctic Wolf Observes Malicious Configuration Changes On Fortinet FortiGate Devices via SSO Accounts"}]} ```