# Attackers Weaponize FortiClient Management Flaw to Deploy Credential-Stealing Malware Disguised as Security Updates


A critical authentication bypass vulnerability in Fortinet's FortiClient Enterprise Management Server (EMS) is being actively exploited in the wild to deliver sophisticated credential-stealing malware, according to research from cybersecurity firm Arctic Wolf. The attack campaign leverages CVE-2026-35616 to infiltrate endpoints through a supply chain angle that particularly raises alarm: legitimate-looking Fortinet security updates deployed through trusted management channels.


## The Threat


Attackers are exploiting an improper access control flaw in FortiClient EMS to execute arbitrary code without authentication. The vulnerability allows remote attackers to bypass security controls entirely, gain administrative privileges, and manipulate core security configurations—all without a single valid credential.


Once authenticated access is obtained, the threat actors deploy EKZ Infostealer, an undocumented credential-stealing malware that targets:


  • Browser-stored credentials and passwords
  • Credit card and financial data
  • Personal information (addresses, phone numbers)
  • Browser cookies that can bypass multi-factor authentication protections
  • Session tokens enabling account takeover

    • The malware operates silently, exfiltrating stolen data to attacker-controlled VPS infrastructure over unencrypted HTTP, then removes traces of its presence to avoid detection.


    ## Background and Context


    Fortinet discovered and confirmed active exploitation of CVE-2026-35616 in early April 2026, releasing emergency hotfixes for FortiClient EMS versions 7.4.5 and 7.4.6. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) responded with immediate action, ordering all federal agencies to secure exposed instances by the end of that week—signaling the severity of the vulnerability.


    The Shadowserver Foundation reported identifying 2,000 internet-exposed FortiClient EMS instances during reconnaissance efforts, indicating widespread vulnerable deployments across organizations globally. Many of these systems appear to remain unpatched months after the vulnerability disclosure and initial emergency guidance.


    The attack campaign was first detailed in research by Arctic Wolf's threat intelligence team in late May 2026, documenting real-world exploitation patterns and the delivery mechanism for EKZ Infostealer. This represents the first known weaponization of CVE-2026-35616 at scale.


    ## Technical Details: The Attack Chain


    The exploitation methodology demonstrates sophisticated understanding of FortiClient architecture and attack surface:


    ### Initial Access

    The attack begins with unauthenticated API calls targeting FortiClient EMS administrative endpoints. Because of the authentication bypass vulnerability, the attacker can:

  • Enumerate system configuration
  • Access administrative interfaces
  • Trigger privileged actions without valid credentials

    • ### Configuration Manipulation

    Once inside, the attacker modifies critical EMS configurations:

  • VPN policy updates - Changes to remote access profiles and tunneling workflows
  • Script injection - Introduction of malicious command execution routines into legitimate FortiClient management workflows
  • Credential manipulation - Updates to authentication parameters used by endpoints

    • ### Payload Delivery Through Trust

    The attack chain's most insidious aspect leverages legitimate trust mechanisms:


    1. Legitimate connection established - FortiClient endpoints establish routine IPsec tunnels to corporate FortiGate firewalls

    2. Malicious script injection - Seconds after tunnel establishment, injected batch scripts execute via Command Prompt through fortitray.exe (a legitimate FortiClient process)

    3. PowerShell invocation - Scripts invoke PowerShell to execute base64-encoded payloads

    4. Trojanized update delivery - The malicious payload is disguised as an official Fortinet security patch or endpoint update

    5. Execution and exfiltration - EKZ Infostealer runs silently, harvests credentials from browser storage, encrypts the data, and transmits it to attacker infrastructure


    The attack leverages the inherent trust that endpoints place in management server directives—a classic supply chain attack vector applied to endpoint management infrastructure.


    ### Detection Indicators


    Arctic Wolf identified specific log patterns associated with successful exploitation attempts:


  • "Certificate not found in request header" errors appearing in authentication logs
  • "Certificate user: fortinet-ca2 successfully updated" entries following authentication failures
  • Unexpected changes to Remote Access Profile configurations
  • New administrative accounts created without authorization
  • Logins from suspicious origins (Tor exit nodes, VPS IP addresses, unfamiliar geographic locations)
  • Administrative actions modifying VPN policies, user accounts, or endpoint configurations

    • ## Implications for Organizations


    This vulnerability and its active exploitation have cascading implications across multiple security domains:


    ### Endpoint Compromise Risk

    Organizations running vulnerable FortiClient EMS instances face complete endpoint compromise risk. Because the malware is deployed through legitimate management channels using legitimate processes, traditional endpoint detection controls may struggle to identify the threat. The attacker gains access to stored credentials, payment card data, and session tokens—enabling lateral movement, data theft, and account takeover.


    ### Multi-Factor Authentication Bypass

    The theft of browser cookies and session tokens undermines MFA protections. Even if an account is protected by multi-factor authentication, stolen session cookies allow attackers to authenticate without triggering MFA challenges, gaining immediate access to email, cloud services, and web applications.


    ### Supply Chain Attack Vector

    This attack demonstrates how critical infrastructure management tools can become attack vectors. IT administrators trust Fortinet updates and directives implicitly. Attackers exploiting the management layer can reach thousands of endpoints simultaneously—a far more efficient approach than targeting individual machines.


    ### Federal Infrastructure Risk

    The CISA emergency order indicates U.S. government agencies use FortiClient EMS extensively. Unpatched systems within federal infrastructure remain actively exploitable, potentially exposing classified networks, law enforcement systems, and national security infrastructure to compromise.


    ## Recommendations


    Organizations must act immediately to address this threat:


    ### Immediate Actions (Week 1)

  • Identify all FortiClient EMS instances in your environment, including those managed by managed service providers (MSPs)
  • Verify patch status - Confirm all instances are running patched versions (7.4.5.x, 7.4.6.x with emergency hotfixes, or newer)
  • Review change logs - Examine the past 90 days of EMS configuration changes, looking for unexpected modifications to VPN policies, script definitions, or user accounts
  • Search logs for the detection indicators provided by Arctic Wolf

    • ### Short-Term Hardening (Weeks 2-4)

  • Restrict EMS network access - Implement network segmentation to limit EMS access to authorized administrators only; disable internet-facing access
  • Enable audit logging - Ensure all administrative actions are logged with user attribution and timestamp data
  • Monitor for suspicious activity - Establish alerts for certificate authentication failures, configuration changes, and administrative logins from unusual origins
  • Rotate credentials - Reset any credentials that may have been harvested from compromised endpoints
  • Review endpoint logs for evidence of EKZ execution (PowerShell invocation, certificate anomalies, malware process execution)

    • ### Long-Term Security Posture

  • Implement Zero Trust architecture for management networks - require authentication for all administrative access, implement micro-segmentation
  • Enable privileged access management (PAM) solutions to limit and monitor administrative actions
  • Conduct threat hunting on all endpoints managed by potentially compromised EMS servers
  • Review MSP agreements - ensure security update responsibility and incident response procedures are documented

    • ---


    ## HackWire Analysis


    This campaign illustrates a critical evolution in supply chain attacks: rather than compromising software distribution channels or inserting backdoors into legitimate software, attackers are increasingly weaponizing the management infrastructure itself. FortiClient EMS is not the endpoint—it's the command center that hundreds or thousands of endpoints implicitly trust.


    What makes this particularly dangerous is the trust transfer problem. Organizations securing their perimeter and endpoints while leaving management infrastructure exposed face a fundamental asymmetry: the defender must protect thousands of systems individually, while the attacker needs to compromise only the management layer once. This attack demonstrates that asymmetry in stark terms.


    The broader pattern is troubling: VPN appliances and endpoint management platforms have become primary targets for sophisticated attackers. SonicWall, Palo Alto Networks, and Fortinet have all released critical vulnerabilities in their security infrastructure over the past 12 months. These aren't obscure products—they're foundational to how enterprises secure remote access and manage fleets of endpoints.


    For defenders, the immediate takeaway is operational: unpatched FortiClient EMS instances are currently burning assets in your environment. The slower realization is architectural: management and security infrastructure requires different security models than the endpoints they protect. A vulnerability in the management layer is force-multiplied across every system it touches. Organizations should conduct immediate inventories of all management infrastructure, enforce strictly isolated networks for administrative access, and implement rigorous logging and monitoring at the management layer.


    The appearance of EKZ infostealer represents the monetization phase of the attack—the proof that credentials stolen at scale through management layer compromise are valuable enough to drive malware development and deployment. Expect more campaigns of this nature.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)