⚠️ FortiClient EMS Hack: Fake Update Steals Passwords
On this page
Hackers are exploiting an authentication bypass vulnerability in FortiClient Enterprise Management Server (CVE-2026-35616) to deliver an undocumented credential-stealing malware called EKZ — and they are disguising it as a legitimate Fortinet update. If you use FortiClient at work or manage endpoints behind a FortiGate firewall, this matters: the attack requires no user interaction and targets browser-saved passwords, credit card details, and session cookies.
The discovery, documented by Arctic Wolf in late May 2026, reveals a sophisticated attack chain that weaponises FortiClient's own VPN scripting workflows. When an endpoint establishes an IPsec tunnel to a FortiGate firewall, the legitimate fortitray.exe process launches malicious batch scripts through Command Prompt seconds later. The malware harvests credentials from Chromium-based and Firefox browsers, exfiltrates them over HTTP to attacker-controlled servers, and removes all traces from the infected endpoint.
This is the kind of attack that TrustyPassword.org exists to educate you about. Most phishing advice focuses on spotting suspicious emails and dodgy links — but the EKZ campaign shows a more dangerous vector: a trusted enterprise management tool being turned against its own users. Understanding how the attack works is the first step to protecting yourself and your organisation.
How the EKZ Infostealer Attack Works
The Vulnerability: CVE-2026-35616
Fortinet's FortiClient Enterprise Management Server (EMS) is a centralised console that IT teams use to manage VPN policies, endpoint compliance, and security configurations across thousands of devices. CVE-2026-35616 is an improper access control flaw rated critical — it allows unauthenticated remote attackers to execute arbitrary code via specially crafted API requests.
Fortinet confirmed active exploitation in early April 2026 and released emergency hotfixes for EMS versions 7.4.5 and 7.4.6. The Cybersecurity and Infrastructure Security Agency (CISA) quickly added the vulnerability to its Known Exploited Vulnerabilities catalogue and ordered federal agencies to patch within a week.
Despite the patch, The Shadowserver Foundation reported approximately 2,000 internet-exposed EMS instances at the time — meaning thousands of organisations remained vulnerable weeks after the fix became available.
The Attack Chain: From API Abuse to Credential Theft
Arctic Wolf's analysis breaks the attack into four stages:
-
Initial compromise. The attacker abuses unauthenticated EMS API endpoints to perform administrative actions — creating new accounts, modifying VPN policies, and updating authentication certificates. One telltale sign was a
"Certificate not found in request header"error followed seconds later by a log entry reading"Certificate user: fortinet-ca2 ... successfully updated". -
Policy manipulation. The attacker modifies Remote Access Profile configurations to introduce malicious script execution. Instead of delivering a generic malware lure, the payload is presented as a Fortinet endpoint update and executed through FortiClient-managed VPN scripting workflows.
-
Payload delivery. Seconds after an endpoint establishes an IPsec VPN tunnel,
fortitray.exe— a legitimate FortiClient process — executes batch commands that invoke PowerShell. The PowerShell payload downloads a base64-encoded binary that runs silently without any visible window or user prompt. -
Data exfiltration and cleanup. The EKZ infostealer targets browser credential stores. It extracts saved passwords, credit card details, addresses, phone numbers, and cookies from both Chromium-based browsers (Chrome, Edge, Brave, Opera) and Firefox. Critically, stolen cookies allow attackers to bypass multi-factor authentication (MFA) for session hijacking — because the site already considers the cookie-authenticated session as "logged in." The malware writes stolen data to text files and sends them over HTTP to an attacker-controlled virtual private server, then deletes its own artifacts.
Why the Fake-Update Tactic Is So Effective
Social engineering through trusted software updates is a proven phishing technique. Users are conditioned to accept update notifications as normal behaviour. When an update prompt appears from a trusted vendor like Fortinet, with timing aligned to a regular VPN connection flow, most users — and indeed most endpoint detection tools — accept it without question.
The EKZ campaign takes this a step further: there is no user-facing prompt at all. The malware executes entirely through trusted system processes (fortitray.exe, cmd.exe, powershell.exe). From the endpoint's perspective, nothing unusual appears to be happening. A tool like bestpasswordgenerator.org's password strength analyser can help you audit your current credentials against leaked databases, but the strongest password in the world won't help if malware on your machine reads it directly from your browser's storage.
Signs Your System May Be Compromised
Arctic Wolf's research identifies several red flags that defenders — and even individual users — can watch for:
| Indicator | What to Look For |
|---|---|
| Certificate errors | "Certificate not found in request header" followed by "user: fortinet-ca2 ... successfully updated" in EMS logs |
| New admin accounts | Unexpected administrator accounts created in FortiClient EMS |
| Suspicious login origins | Admin logins from Tor exit nodes, unknown VPS IP addresses, or unfamiliar geographic regions |
| Configuration changes | Unexpected modifications to Remote Access Profile settings or VPN policy rules |
| Endpoint behaviour | fortitray.exe spawning cmd.exe or powershell.exe during VPN tunnel establishment |
If you manage a FortiClient deployment and see any of these signs, assume compromise and begin incident response immediately.
Protecting Yourself Beyond Patching
Patching CVE-2026-35616 is the first and most critical step. But the EKZ campaign is a reminder that credential security requires layers of defence:
1. Use a Password Manager
Browser-saved passwords are convenient but dangerous. A dedicated password manager like NordPass encrypts your vault with a master password that the browser cannot read. Even if EKZ-level malware infects your machine, properly encrypted password vaults are significantly harder to exfiltrate than browser credential stores.
2. Monitor for Breached Credentials
Services like Have I Been Pwned (HIBP) let you check whether your email address or passwords have appeared in known data breaches. Enable notifications so you're alerted the moment a new breach affects your accounts.
3. Separate Your Browsing Activities
Keep work credentials in a dedicated browser profile or container that doesn't mix with personal browsing. This limits the blast radius if an infostealer infects one environment but cannot reach credentials stored in the other.
4. Use Encrypted Communication Channels
When remote administration is required, ensuring your communication channels are encrypted prevents credential interception during transit. Trekmail provides end-to-end encrypted email and secure messaging that protects sensitive credentials and internal communications from packet sniffing and man-in-the-middle attacks.
5. Endpoint Security with Layered Protection
A comprehensive security suite goes beyond antivirus. Kaspersky Premium includes behaviour-based detection that flags unusual process chains — like fortitray.exe launching PowerShell — as suspicious activity, even if the malware itself is not yet in known-threat databases.
6. Encrypt Your Internet Connection
When connecting to work resources from remote locations, an encrypted VPN tunnel prevents network-level credential interception. Hide My Name VPN offers a no-logs service that encrypts all traffic between your device and the corporate network, blocking packet-sniffing attacks on public or untrusted Wi-Fi.
7. Network-Level Protection
For organisations managing remote workforces, network-level security appliances can detect and block the outbound connections that infostealers use to exfiltrate data. Turbo VPN provides business-grade encryption that makes it harder for attackers to establish the command-and-control channels they need, while its zero-log policy ensures no session data is stored that could later be compromised.
The Bigger Picture: Credential Theft in 2026
The EKZ campaign is not an isolated incident. The Verizon 2025 Data Breach Investigations Report (DBIR) found that 81% of hacking-related breaches involve stolen or weak credentials. IBM's 2026 Cost of a Data Breach Report puts the average breach cost at $4.88 million — the highest figure in the study's 21-year history.
What makes the EKZ campaign different is the delivery method: an enterprise VPN management tool weaponised against its own users. Traditional phishing defence focuses on email gateways and user training, but when the infection vector is a legitimate enterprise application, those defences are blind.
The Open Web Application Security Project (OWASP) has long warned that supply-chain and trusted-vector attacks are among the hardest to defend against. The EKZ campaign validates that warning with real-world impact.
Building a Multi-Layer Anti-Phishing Defence
Our testing at TrustyPassword.org confirms what security researchers have been saying for years: no single tool prevents credential theft. The most effective defence is a layered approach:
- Prevent: Patch vulnerabilities promptly. CISA's Known Exploited Vulnerabilities catalogue is a free resource that lists every actively exploited flaw — check it weekly.
- Detect: Monitor for the behavioural indicators listed above. Certificate anomalies, unexpected admin accounts, and unusual process chains are your early-warning system.
- Respond: Have an incident response plan that assumes credentials are compromised. Force password resets, rotate API keys, invalidate sessions, and review access logs.
- Recover: Use encrypted backups, maintain offline credential vaults, and ensure your password manager master password follows NIST SP 800-63B guidelines (minimum 8 characters entropy, or a 5-word diceware passphrase as recommended by the NCSC).
Frequently Asked Questions
Is my personal FortiClient installation affected?
The EKZ campaign targets FortiClient Enterprise Management Server (EMS), not individual FortiClient installations. If you use FortiClient as a standalone VPN client without an EMS-managed deployment, your risk is lower. However, the CVE-2026-35616 vulnerability affects the EMS component specifically, so check with your IT team about whether your organisation runs EMS.
Can antivirus software detect the EKZ infostealer?
Standard signature-based antivirus may not detect EKZ because it is an undocumented malware sample with no known hash signatures. Behaviour-based detection — which monitors for suspicious process chains rather than known file hashes — is more effective. Comprehensive security suites with behaviour analysis, like those described above, offer stronger protection.
Does changing my password help if I have an active infection?
Not until you clean the malware from your system. If the EKZ infostealer is actively running on your machine, any new password you type will be captured the same way. Always remove the infection first (reboot into safe mode, run a full scan, check for unfamiliar scheduled tasks and startup entries), then change passwords from a clean device.
Can stolen cookies really bypass two-factor authentication?
Yes. Many websites treat an active session cookie as proof of authentication. When an attacker steals your session cookie, the service sees an already-authenticated user and does not prompt for a second factor. This is called session hijacking or cookie replay. Using short session timeouts and binding sessions to IP addresses or device fingerprints can mitigate this risk, but the most effective prevention is keeping cookies out of malware's reach in the first place.
Does this attack affect mobile devices?
The current EKZ campaign targets Windows endpoints only. However, credential-stealing malware for mobile platforms exists and is increasingly common. The OWASP Mobile Security Project tracks mobile-specific threats, and we recommend using a dedicated password manager on mobile devices rather than relying on browser-saved credentials.
Has CISA issued guidance for this vulnerability?
Yes. CISA added CVE-2026-35616 to its Known Exploited Vulnerabilities catalogue in April 2026 and ordered federal agencies to patch within seven days. They also published detection guidance recommending that organisations monitor EMS logs for certificate authentication anomalies, unexpected admin account creation, and unusual Remote Access Profile modifications.