Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer
Attackers are abusing a patched FortiClient EMS flaw to push a credential stealer through trusted management paths. Arctic Wolf says the campaign hides malware as a Fortinet update and uses PowerShell for delivery and theft.
Intelligence analysis by GPT-5.4 Mini
Arctic Wolf says threat actors exploited CVE-2026-35616 in FortiClient EMS to alter management settings and distribute malicious scripts to managed endpoints. The payload masquerades as a Fortinet update, steals browser data, and sends captured results to attacker-controlled infrastructure.
A computer security team found bad actors sneaking through a tool that companies use to manage many work computers at once. Instead of breaking into each machine one by one, they used the manager tool itself to send out a hidden bad file.
It is like a school announcement system being tricked into reading a fake message to every classroom. Because the message comes from a trusted system, the computers are more likely to listen.
The bad file tried to steal passwords and other personal details from web browsers. That matters because those stolen bits can help the attackers get into email, cloud tools, and other private places later.
Analysis
What happened
Arctic Wolf says it observed threat actors abusing a critical FortiClient Endpoint Management Server flaw, CVE-2026-35616, in May 2026. The issue is a pre-authentication API access bypass that can lead to privilege escalation, and Fortinet fixed it in FortiClient EMS 7.4.7 and later.
How the attack worked
After gaining access, the attackers reportedly changed EMS configuration so upgrade reminders were deferred and a malicious script was inserted into a Remote Access Profile and endpoint policy. That let them use FortiClient's own management path to push commands to managed endpoints in a way that looked like routine administration.
Arctic Wolf says the chain also used fortitray.exe, a legitimate FortiClient component, to launch a .cmd file through cmd.exe. That script invoked a Base64-encoded PowerShell payload that downloaded and ran malware, then sent results to 83.138.53[.]110 over HTTP POST.
The payload
The fake updater, FortiEndpoint_Patch.exe, is described as a previously unreported Windows information stealer. It collects passwords, cookies, and autofill data such as card details, addresses, and phone numbers from Chromium- and Gecko-based browsers. The stolen data is written to a log file in ProgramData, while the PowerShell stage handles exfiltration.
Why defenders should care
The attack shows how abusing trusted management infrastructure can scale fast: once EMS configuration is modified, every managed endpoint becomes a possible target. Arctic Wolf also noted that stolen session cookies and saved credentials could provide follow-on access to cloud services and internal applications, including cases where session reuse may bypass MFA prompts.
Key points
- Arctic Wolf says attackers exploited CVE-2026-35616 in FortiClient EMS, a critical pre-authentication API bypass.
- The campaign used FortiClient's own management features to push malicious scripts to managed endpoints.
- The payload was disguised as a Fortinet endpoint update and launched through PowerShell.
- The stealer collects browser passwords, cookies, and autofill data, then the script exfiltrates it to attacker infrastructure.
- Stolen session cookies and credentials could help attackers reach cloud services and internal apps, possibly bypassing MFA in some cases.
