A sophisticated attack campaign is exploiting a critical vulnerability in Fortinet's enterprise infrastructure to deploy an advanced credential stealer that masquerades as legitimate security updates. The campaign represents a concerning evolution in threat actor tactics, combining zero-day exploitation with social engineering to bypass traditional security controls.
The attacks center on CVE-2026-35616, an authentication bypass vulnerability affecting FortiClient Enterprise Management Server (EMS). This critical flaw allows remote attackers to execute arbitrary commands without authentication, effectively granting them administrative control over enterprise VPN infrastructure.
The Attack Vector: Exploiting Trust in Security Infrastructure
What makes this campaign particularly dangerous is how attackers leverage the trusted nature of security infrastructure itself. Rather than deploying generic malware, threat actors disguise their payload as a Fortinet endpoint update, distributed through the very VPN management workflows that organizations rely on for security.
The attack sequence follows a precise pattern:
This approach exploits a fundamental trust relationship between enterprise security tools and endpoint systems. When legitimate security software initiates what appears to be a routine update, users and security controls typically don't scrutinize the process with the same rigor applied to external downloads.
EKZ Infostealer: A Purpose-Built Credential Harvester
The payload, designated EKZ Infostealer, represents a sophisticated evolution in credential theft capabilities. Unlike opportunistic malware that targets whatever data is available, EKZ specifically focuses on high-value authentication assets that enable persistent access to corporate systems.
The malware targets multiple browser types, extracting stored credentials, payment information, and authentication cookies. Particularly concerning is its ability to harvest session cookies that can bypass multi-factor authentication protections, providing attackers with ready access to protected accounts without triggering additional security alerts.
The strategic focus on authentication bypass mechanisms demonstrates threat actors' understanding that initial access is often less valuable than persistent, undetected access to enterprise resources.
Technical analysis reveals EKZ operates with minimal system footprint, executing silently and removing local artifacts after data exfiltration. This approach minimizes detection opportunities and complicates incident response efforts.
The Broader Threat Landscape
This campaign highlights a troubling trend toward infrastructure-level compromises that abuse trusted security tools. When attackers can leverage legitimate security infrastructure for malicious purposes, traditional detection mechanisms become significantly less effective.
The rapid response from CISA, ordering federal agencies to patch vulnerable systems within days, underscores the severity of the threat. However, with thousands of internet-exposed EMS instances identified by security researchers, the attack surface remains substantial.
The timing and sophistication of these attacks suggest well-resourced threat actors with deep understanding of enterprise security architectures. The precise targeting of VPN management infrastructure indicates likely reconnaissance and planning phases that preceded the actual exploitation.
What You Should Do
Organizations running FortiClient EMS must take immediate action to secure their infrastructure:
- Patch immediately: Apply emergency hotfixes for EMS versions 7.4.5 and 7.4.6 without delay
- Monitor authentication logs: Look for certificate-related errors followed by unexpected successful authentications
- Review VPN configurations: Audit Remote Access Profile settings for unauthorized modifications
- Implement behavioral monitoring: Deploy detection rules for unusual administrative activities, especially from unfamiliar source IPs
- Validate endpoint security: Ensure endpoint detection capabilities can identify disguised payloads, even when distributed through trusted channels
Beyond immediate remediation, this incident should prompt broader security architecture reviews. Organizations must evaluate how they distinguish between legitimate security tool activities and potential abuse of those same tools by threat actors.
The sophisticated nature of this campaign serves as a stark reminder that attackers are increasingly targeting the security infrastructure itself. As enterprise networks become more complex and interconnected, the potential for abuse of trusted security tools will only continue to grow, requiring defenders to adopt more nuanced detection and response strategies.
