EKZ Stealer Exploits Fortinet EMS Vulnerability and Uses Obfuscated Control Flow

Jun 25, 2026 · Original article ↗

Summary

eSentire reports that attackers exploited CVE-2026-35616 in Fortinet EMS to deploy EKZ Stealer, harvest browser credentials and exfiltrate them via PowerShell. The article details Binary Ninja workflows for reversing the malware’s obfuscation.

Key points

In May 2026, eSentire detected EKZ Stealer in a customer environment after attackers exploited CVE-2026-35616 in Fortinet EMS versions 7.4.5–7.4.6.
The malware was delivered as FortiEndpoint_Patch.exe and harvested credentials from Chromium-based browsers and Firefox.
PowerShell encoded the collected credentials in Base64 and sent them in an HTTP POST request to 83.138.53[.]110.
EKZ Stealer used indirect jumps and calls, opaque predicates, control-flow flattening, and encrypted strings to hinder analysis.
The researchers used Binary Ninja Workflows to resolve indirect control flow and rewrite LLIL and MLIL expressions; an associated plugin, DispatchThis, is available.
eSentire isolated the affected host and assisted with remediation. It recommends patching and restricting Fortinet EMS access, and reviewing EMS logs for exploitation indicators.

Article Details

Attack Vectors: Threat actors exploited CVE-2026-35616, an improper access control vulnerability in Fortinet EMS versions 7.4.5 through 7.4.6, to compromise a customer EMS server.
PowerShell downloaded EKZ Stealer from the identified host, saved it as FortiEndpoint_Patch.exe to disguise it as a Fortinet update, and executed it.
EKZ Stealer harvested credentials from Chromium-based browsers and Firefox, wrote them to C:\ProgramData\log.txt, and the PowerShell command exfiltrated the file in a Base64-encoded HTTP POST.
EKZ Stealer used compiler-based obfuscation, including indirect jumps and calls, control-flow flattening, and XOR-based string encryption.
Defensive Notes: Patch and harden Fortinet EMS, and restrict access to trusted networks using measures such as VPNs or allowlists.
Review and monitor Fortinet EMS logs for exploitation activity, particularly entries containing "Certificate not found in request header."
Use NGAV or EDR at minimum; the article also recommends a 24/7 multi-signal MDR service.
The eSentire team isolated the affected host, assisted with remediation, and reported ongoing monitoring and detection-content development for campaigns targeting Fortinet EMS.

Indicators of compromise

Type	Indicator	Context
IPV4	`83[.]138[.]53[.]110`	Dropper and credential-exfiltration host; the PowerShell command downloads the stealer and posts harvested credentials to it.
SHA256	`0da123adf9251957a4b850a3f6bd6a753dd4892be176a84a18450e899534cc5e`	Hash identified for FortiEndpoint_Patch.exe, the EKZ Stealer sample.
URL	`hxxp[:]//83[.]138[.]53[.]110/dl/p[.]exe`	Payload-download URL used by the PowerShell command to retrieve EKZ Stealer.
URL	`hxxp[:]//83[.]138[.]53[.]110/service/save[.]php`	Credential-exfiltration URL used by the PowerShell command for an HTTP POST.