A newly observed campaign abused trusted endpoint management infrastructure to deploy a credential stealer across managed enterprise devices silently.
In May 2026, Arctic Wolf uncovered an active exploitation campaign targeting organizations running FortiClient Endpoint Management Server (EMS).
Threat actors leveraged CVE-2026-35616, an improper access control vulnerability, to bypass API authentication and hijack legitimate administrative workflows, ultimately deploying a previously undocumented credential stealer dubbed EKZ Infostealer across hundreds of managed endpoints.
FortiClient Vulnerability Exploited
CVE-2026-35616 is an unauthenticated access control bypass in FortiClient EMS. By sending specially crafted HTTP requests to certain EMS endpoints without valid credentials, attackers can interact with privileged EMS functionality as if they were authenticated administrators.
The vulnerability was first reported to Fortinet on March 31, 2026, after it was observed being exploited in the wild.
Once access was established, threat actors modified Remote Access Profile configurations and endpoint policies to embed malicious scripts.
FortiClient EMS supports on_connect scripting directives for VPN tunnels and attackers weaponized this trusted feature to push execution commands to every managed endpoint simultaneously, without requiring individual device compromises.
The malicious execution chain followed a precise pattern. When affected endpoints established an IPsec tunnel, fortitray.exe launched .cmd script files from within FortiClient’s own VPN logging directory.
C:\Program Files\Fortinet\FortiClient\logs\Trace\scripts{GUID}.cmd
These scripts decoded and executed base64-encoded PowerShell, which downloaded the payload from a threat-actor-controlled server at 83[.]138[.]53[.]110.
The executable downloaded on victim machines, FortiEndpoint_Patch.exe, was disguised as a legitimate Fortinet endpoint patch.
In reality, it was EKZ Infostealer, a MinGW-compiled Windows credential harvester that Arctic Wolf first observed in this campaign. The full process chain observed was:
fortitray.exeoripsec.exe→cmd.exe→powershell.exe→FortiEndpoint_Patch.exe
EKZ Infostealer supports credential extraction from Chrome, Microsoft Edge, Firefox, and other Chromium and Gecko-based browsers.
For Chromium-family browsers, it bypasses Chrome’s v20 AES-256 encryption by copying itself into the browser’s Application directory and calling IElevator::DecryptData through the Chromium Elevation Service.
For Firefox-based browsers, it dynamically loads nss3.dll to extract credentials from key4.db, logins.json, and cookies.sqlite.
Harvested data, including saved passwords, session cookies, and autofill information such as credit card numbers and addresses, is written to a log.txt file in the ProgramData directory, then exfiltrated via HTTP POST to the attacker’s VPS.
Session cookies pose a particularly elevated risk, as they can enable threat actors to bypass MFA on cloud services and internal applications.
IOCs
| Indicator | Type | Description |
|---|---|---|
83[.]138[.]53[.]110 | IP Address | Threat-actor C2 / payload host |
185[.]220[.]101[.]15 | IP Address | Tor exit node (malicious login) |
192[.]42[.]116[.]14 | IP Address | Tor exit node (malicious login) |
0da123adf925...534cc5e | SHA-256 | FortiEndpoint_Patch.exe |
hxxp://83.138.53[.]110/dl/p.exe | URL | Payload delivery URL |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Mitigation
Organizations running affected FortiClient EMS versions should upgrade to a patched release immediately. Additionally, network access to the EMS management port 8013 should be restricted to trusted IP ranges only.
Defenders should hunt for the certificate error log lineCertificate not found in request header as an early indicator of exploitation attempts, and audit Remote Access Profile and endpoint policy configurations for unauthorized script insertions.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
