FortiBleed EKZ Stealer credential exfil POST to 83.138.53.110/service/save.php

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•4

Detects HTTP POST requests directed at a specific suspicious endpoint (/service/save.php) on a known malicious host (83.138.53.110), consistent with the exfiltration behavior of the FortiBleed EKZ stealer malware. The rule identifies potential credential theft and exfiltration over standard web protocols.