Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer

Arctic Wolf observed exploitation of CVE-2026-35616 in FortiClient EMS to distribute EKZ Infostealer by pushing a malicious update ('FortiEndpoint_Patch.exe') and Base64-encoded PowerShell scripts through EMS; the malware harvests browser cookies, saved credentials and autofill data, writes logs to ProgramData, and exfiltrates captured data via an HTTP POST to 83.138.53.110, while attackers modified EMS configurations and remote access profiles to push commands to all managed endpoints.