FortiClient EMS Flaw Exploited to Deploy EKZ Infostealer
Summary
Arctic Wolf reports attackers exploiting CVE-2026-35616 in FortiClient EMS to deliver EKZ infostealer through VPN scripting. Fortinet released hotfixes, and CISA directed federal agencies to secure affected instances.
Key points
- Arctic Wolf observed attacks abusing unauthenticated FortiClient EMS endpoint APIs to modify configurations and VPN policies.
- Malicious scripts launched through FortiClient VPN workflows ran a PowerShell payload disguised as a Fortinet update.
- The EKZ infostealer targets Chromium- and Firefox-based browsers for credentials, cookies, payment data, and other personal information.
- Arctic Wolf says attackers exfiltrated harvested data over HTTP and removed local artifacts.
- Researchers recommend checking logs for certificate-authentication anomalies and monitoring unexpected Remote Access Profile changes.
- Fortinet confirmed exploitation and released emergency hotfixes for EMS versions 7.4.5 and 7.4.6; CISA ordered federal agencies to secure their instances.
Article Details
- Event Type
- Reported exploitation of CVE-2026-35616, an authentication-bypass and improper-access-control flaw in FortiClient EMS, to deliver the EKZ credential stealer through FortiClient-managed VPN scripting workflows.
- Impact
- The reported attacks execute malicious PowerShell on affected endpoints and exfiltrate browser data. EKZ targets Chromium-based and Firefox browsers and is reported to steal credentials, cookies, payment-card details, addresses, and phone numbers, potentially enabling access to accounts protected by multi-factor authentication.
MITRE ATT&CK
CVE
Malware
Vendors
Products
FortiClient EMSHackers are exploiting CVE-2026-35616 in FortiClient Enterprise Management Server (EMS) to deploy the EKZ credential stealer by abusing FortiClient VPN scripting workflows and disguising the payload as a Fortinet update.FortiClient VPNHackers are exploiting CVE-2026-35616 in FortiClient Enterprise Management Server (EMS) to deploy the EKZ credential stealer by abusing FortiClient VPN scripting workflows and disguising the payload as a Fortinet update.Fortinet FortiGateSeconds after endpoints established an IPsec tunnel to a FortiGate firewall, the legitimate fortitray.exe launched malicious batch scripts through Command Prompt.