Hackers exploit FortiClient EMS flaw to push infostealer malware
Recorded: May 28, 2026, 6:03 p.m.
| Original | Summarized |
Hackers exploit FortiClient EMS flaw to push infostealer malware News Featured Glassworm botnet disrupted after resilient C2 infrastructure takedown CISA gives feds 4 days to patch actively exploited cPanel plugin flaw Windows 11 KB5089573 update released with performance improvements Charter confirms data breach after ShinyHunters extortion threat Hackers exploit FortiClient EMS flaw to push infostealer malware New Gogs zero-day flaw lets hackers get remote code execution How SIEM helps MSPs reduce noise and stop threats faster Romanian gets 5 years in prison for hacking Oregon govt network Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityHackers exploit FortiClient EMS flaw to push infostealer malware Hackers exploit FortiClient EMS flaw to push infostealer malware By Bill Toulas May 28, 2026 Hackers are exploiting an authentication bypass vulnerability (CVE-2026-35616) in FortiClient Enterprise Management Server (EMS) to deliver an undocumented credential stealer called EKZ. Malicious PowerShell codeSource: Arctic Wolf Stealer executes without argumentsSource: Arctic Wolf The Validation Gap: Automated Pentesting Answers One Question. You Need Six. Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.This guide covers the 6 surfaces you actually need to validate. Related Articles: Actively Exploited Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Upcoming Webinar Popular Stories FBI warns of Kali365 phishing service targeting Microsoft 365 accounts Charter confirms data breach after ShinyHunters extortion threat Microsoft Defender can now automatically isolate hacked endpoints Sponsor Posts AI is a data-breach time bomb: Read the new report Protect Your Business from Ecommerce Fraud #1 MSP Benchmark report 2026: Insights from 1,000+ MSPs on growth, security, artificial intelligence, and key 2026 trends. Overdue a password health-check? Audit your Active Directory for free Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Hackers successfully exploited an authentication bypass vulnerability, specifically CVE-2026-35616, within the FortiClient Enterprise Management Server (EMS) to deploy an undocumented credential stealer known as EKZ. This vulnerability stemmed from an improper access control flaw that permitted unauthenticated remote attackers to execute arbitrary code or commands through specially crafted requests. Fortinet acknowledged this exploitation and released emergency hotfixes for versions 7.4.5 and 7.4.6 of the product. The malicious activity was observed by cybersecurity researchers, including Arctic Wolf, who noted that the intrusion began by abusing endpoint APIs to perform administrative actions without proper authentication. The attackers leveraged this access to modify the EMS configuration and VPN policies to introduce the execution of malicious scripts. The exploitation pathway demonstrated a multi-stage attack: immediately following the establishment of an IPsec tunnel to a FortiGate firewall, legitimate components like fortitray.exe were used to launch malicious batch scripts via the Command Prompt. These scripts subsequently executed a base64-encoded PowerShell payload designed to download and run malware disguised as a Fortinet endpoint update. This process allowed the payload, tracked as the EKZ Infostealer, to exfiltrate data to an attacker-controlled Virtual Private Server over HTTP. The payload was specifically designed not just as a generic malware lure but was presented as a Fortinet endpoint update executed through FortiClient-managed VPN scripting workflows. On affected endpoints, the FortiClient components initiated command scripts that invoked PowerShell, which in turn downloaded, executed silently, and exfiltrated harvested data before removing local artifacts. The EKZ Infostealer is capable of performing standard information-stealing functions, targeting data from both Chromium-based and Firefox web browsers, extracting stored data into text files while effectively bypassing encrypted password protections. This stealer targets sensitive information including credentials, credit card details, addresses, phone numbers, and cookies, allowing attackers access to accounts protected by multi-factor authentication without necessitating a login. Researchers indicated that a specific indicator of this exploitation attempt involves anomalous certificate behavior, noting the sequence where an error message regarding a missing certificate was followed immediately by a successful certificate update within seconds, suggesting system manipulation. Therefore, defenders are advised to scrutinize certificate-authentication anomalies and any unexpected alterations to Remote Access Profile configurations. Furthermore, detecting suspicious administrative activity, such as the creation of new accounts or logins originating from unfamiliar sources like Tor or Virtual Private Server IP addresses, should be treated as critical red flags. Arctic Wolf provided extensive detection guidance derived from their findings to aid organizations in preventing similar attacks. |