![\"Illustrative](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/10\/ekz.png\" "\\"\\"")
<\/figure>\nOverview<\/h2>\nEKZ is a browser-data stealer, not a legitimate patch<\/h3>\n
EKZ Stealer is Windows malware designed to collect browser credentials and other stored information. Its cleanup must be paired with protection of potentially exposed accounts.<\/p>\n
Arctic Wolf documented a campaign involving compromised FortiClient EMS management and a payload called Having FortiClient installed does not mean you have EKZ. A deployment history, security detection, and the actual management environment are needed to assess an individual device.<\/p>\n The primary analysis describes EKZ exporting collected browser data to a local file. Surrounding script activity then handles sending that output away.<\/p>\n That distinction matters during investigation. Looking only for a network connection from the stealer executable could miss activity performed by another component.<\/p>\n It also explains why deleting one suspicious file is not a complete response. The source of deployment and any associated scripts require review.<\/p>\n The image is a fictional file-details illustration, not an actual Windows property sheet or scan result. It highlights the reported filename without authenticating a particular file.<\/p>\n People are often told to avoid unfamiliar downloads. This campaign is a reminder that the delivery system can matter as much as the download\u2019s appearance.<\/p>\n On an employer\u2019s computer, software may arrive through tools controlled by administrators. The employee may not see the same installation choices as a home user.<\/p>\n If that management route is abused, the absence of a suspicious email does not rule out an incident. Investigators need to trace the actual deployment.<\/p>\n Nor should the employee assume a legitimate client application has become inherently malicious. A real tool can carry instructions that an unauthorized party inserted elsewhere.<\/p>\n The practical response is coordinated. The endpoint owner and management administrator each hold information the other may not see.<\/p>\n A user can report the moment a warning appeared. An administrator can examine policy changes, deployment records, and whether other managed computers encountered related activity.<\/p>\n Neither should decide the scope from the filename alone. A malicious file can use a reassuring name, and an unrelated file can share a similar label.<\/p>\n Preserve exact detection names, file locations, and timestamps privately. Those details help a technician compare an alert with the documented campaign.<\/p>\n Don\u2019t repeatedly reconnect to the VPN to see whether the behavior happens again. Repeating an unknown trigger is not a safe diagnostic method.<\/p>\n The reported campaign involved CVE-2026-35616 in FortiClient EMS. Attackers used unauthorized management access to alter settings involved in endpoint VPN workflows.<\/p>\n For the reader, the important consequence is that the apparent instruction source could be a managed configuration rather than an obvious unsolicited attachment.<\/p>\n Administrators should assess their own deployment against the vendor\u2019s current advisory. Do not apply a historical version list without checking the product and release actually installed.<\/p>\n End users should not attempt to repair a shared management server. Report the endpoint evidence to the team authorized to investigate it.<\/p>\n Arctic Wolf observed script execution associated with VPN activity and delivery of the patch-named executable. The name supplies an appearance of routine endpoint maintenance.<\/p>\n A file calling itself a patch is not the same as a verified vendor update. Its provenance and execution history need examination.<\/p>\n If your security software blocked an item, record whether the result was blocked, quarantined, or merely detected. Those outcomes can imply different exposure.<\/p>\n Don\u2019t restore a quarantined file just because its name resembles approved software. Ask the responsible security team to evaluate the alert.<\/p>\n The analyzed tool targets Chromium-family and Firefox-family browser information, including saved logins and cookies. Collected information is written locally for later handling.<\/p>\n A saved session can represent access even when you did not type a password during the incident. Include already signed-in services in the assessment.<\/p>\n The possible scope depends on the data available on that device. A campaign\u2019s capabilities do not prove that every account on every computer was accessed.<\/p>\n Still, an absence of visible disruption is not reassuring enough. Information theft can matter while the browser continues to work normally.<\/p>\n The documented script handles exfiltration around the stealer\u2019s local output. Investigating the executable without its surrounding process activity leaves an incomplete picture.<\/p>\n Security staff should preserve relevant endpoint and network records before routine cleanup destroys useful context. That decision is especially important on shared or managed infrastructure.<\/p>\n Device remediation cannot recall a password that has already been copied. Account protection must proceed according to the exposure identified by the investigation.<\/p>\n Restoring a computer to service also requires confidence that the management route will not deliver the same problem again.<\/p>\n Start with services used in the affected browser. Identify which were signed in and which credentials were stored there during the suspected period.<\/p>\n Replace exposed passwords through the genuine services. Also inspect the session controls each service provides, rather than assuming a replacement automatically closes every connection.<\/p>\n Check unfamiliar devices, recovery options, and authorized applications. A compromised login may be used to establish another access method that deserves its own removal.<\/p>\n A mailbox often receives password-reset links and security notifications. If it was accessible, protect it early and review changes to forwarding or filtering.<\/p>\n Then examine important services that use that mailbox for recovery. Look for actual reset requests and suspicious activity rather than guessing that every service was taken over.<\/p>\n Work accounts can require administrator assistance. The organization may need to revoke sessions or investigate records that the ordinary account holder cannot access.<\/p>\n If payment information was stored or a suspicious charge appears, contact the issuer through a known number. Explain the incident without declaring an unobserved transaction fraudulent.<\/p>\n Keep transaction references and the period of potential exposure. The issuer can explain available controls and what additional evidence it needs.<\/p>\n A bank conversation should be independent of anyone who contacts you claiming to investigate EKZ. Don\u2019t transfer funds because a stranger describes them as unsafe.<\/p>\n A workstation scan answers questions about the workstation. It does not, by itself, establish that the management server and deployment policies are trustworthy.<\/p>\n Separate those workstreams in the incident record. Otherwise, an endpoint may return to an environment where the original source of instructions remains unresolved.<\/p>\n Review unexpected management changes and identify which devices received the affected configuration. Preserve relevant logs with consistent time references.<\/p>\n Compare alerts across the managed group without assuming identical outcomes. One endpoint may have blocked execution while another encountered a different stage.<\/p>\n If business access was available, involve the owners of those systems. A technically successful cleanup does not settle whether a copied account was used elsewhere.<\/p>\n Document the difference between confirmed compromise and precautionary containment. That distinction makes escalation, customer communication, and recovery planning more accurate.<\/p>\n Use current vendor guidance for patching and support. A security advisory can change as additional fixed releases and affected configurations become clear.<\/p>\n A patch closes a vulnerability; it does not automatically remove previously deployed malware or invalidate secrets stolen before the patch.<\/p>\n Before broad credential changes, coordinate the sequence with service owners. Replacing shared access without a plan can interrupt recovery while leaving the actual compromised route active.<\/p>\n Likewise, do not export sensitive logs into an unapproved public tool for convenience. Browser data and deployment records may contain private information requiring controlled handling.<\/p>\n Stop sensitive work on the affected computer.<\/strong> Don\u2019t log in to financial, administrative, or personal accounts while the endpoint is under assessment.<\/p> Contact your genuine security team from another device. Follow its containment instructions, including network isolation when appropriate, without attempting an uncoordinated wipe.<\/p><\/li>\n Preserve the detection and timeline.<\/strong> Record the alert\u2019s full wording, status, time, and the file involved. Note relevant VPN connections or update activity.<\/p> Don\u2019t execute the suspect file for confirmation. A technician can investigate safely without asking you to reproduce a potentially harmful launch.<\/p><\/li>\n Inspect Windows with trusted tools.<\/strong> Malwarebytes can help identify malicious and unwanted components. Use the Windows section of the reusable guide below.<\/p> On a managed endpoint, coordinate scanning with the incident team. Its evidence-preservation and response tools may require a particular order of work.<\/p><\/li>\n Investigate management-side delivery.<\/strong> Authorized administrators should review the relevant EMS deployment, VPN profiles, and current vendor remediation guidance.<\/p> Do not uninstall legitimate corporate software indiscriminately. The aim is to establish what changed, who received it, and whether the original delivery route is secure.<\/p><\/li>\n Recover exposed online access from a clean device.<\/strong> Prioritize valuable services and email, then change passwords and revoke suspicious sessions as the providers allow.<\/p> Review recovery contacts and authentication methods. If an attacker altered those controls, follow the provider\u2019s formal recovery process or your organization\u2019s administrator-led procedure.<\/p><\/li>\n Handle financial findings through the relevant institution.<\/strong> Report suspicious card activity or unauthorized access with dates, references, and a clear description of what happened.<\/p> Ask about appropriate protective steps. No security application can guarantee reimbursement, erase a remote copy of data, or reverse a transaction.<\/p><\/li>\n Choose a safe restoration plan.<\/strong> If the device needs rebuilding, preserve required evidence first and restore only material assessed as appropriate.<\/p> A full old environment can restore unwanted components or settings. Agree on the source of software, the condition of backups, and who approves normal use.<\/p><\/li>\n Keep prevention tied to the actual entry route.<\/strong> Update systems and strengthen management access under the responsible team\u2019s control.<\/p> AdGuard may reduce exposure to malicious advertising during ordinary browsing. It does not repair an exploited management server or remove a compromised VPN-profile instruction.<\/p><\/li>\n<\/ol>\n Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Free<\/strong> \u2014 one of the most trusted malware removal tools available.<\/p>\n\n The free version detects and removes the most common threats, including:<\/p>\n\n \ud83d\udc49 Select your device below<\/strong> \u2014 Windows, Mac, or Android \u2014 then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.<\/p>\n\nFortiEndpoint_Patch.exe<\/code>. The legitimate Fortinet product was being abused as a delivery route.<\/p>\nThe campaign and the stealer perform different jobs<\/h3>\n
Contain the exposure without dismantling legitimate management<\/h3>\n
\n
Why a Managed Update Can Be the Wrong Place to Put Your Trust<\/h2>\n
How the Documented EKZ Infection Chain Unfolds<\/h2>\n
Step 1: Attackers abuse the management environment<\/h3>\n
Step 2: A VPN-related workflow launches a misleadingly named payload<\/h3>\n
Step 3: Browser information is collected<\/h3>\n
Step 4: Other script activity transfers the collected output<\/h3>\n
Which Browser Information Deserves Immediate Attention?<\/h2>\n
Saved passwords and active sessions need separate checks<\/h3>\n
Email may provide a route into other accounts<\/h3>\n
Payment details call for accurate reporting<\/h3>\n
What Administrators Need Before They Call an Endpoint Clean<\/h2>\n
What to Do If EKZ Stealer Is Detected or Suspected<\/h2>\n
\n
Is Your Device Infected? Run a Free Malware Scan<\/h2>\n\n
\n