Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer

Hackers exploit FortiClient EMS flaw to push infostealer malware

Attackers exploit CVE-2026-35616 in FortiClient EMS to deploy the EKZ infostealer via VPN scripting, targeting 2,000 exposed instances. The flaw allows unauthenticated RCE and MFA bypass via cookie theft; Fortinet patched 7.4.5/7.4.6—apply immediately.