If you run Fortinet’s FortiClient endpoint security, this one’s worth five minutes of your morning. Security firm Arctic Wolf has caught attackers abusing a known flaw in FortiClient Enterprise Management Server (EMS) — the console IT teams use to manage Fortinet software across every device — to push a fake “Fortinet patch” that’s actually an infostealer. As reported by Help Net Security, the attacks ran through May using CVE-2026-35616, an access-control bug that lets an unauthenticated attacker send crafted requests to EMS and have them treated as legitimate administrator actions.

From there it turns nasty. The attackers edited the endpoint policy inside EMS to deploy a file called FortiEndpoint_Patch.exe to managed devices. It looks like a routine update. It’s malware — a credential stealer the researchers named EKZ — and it scrapes saved passwords, autofill data and active session cookies out of every major browser, including Chrome, Edge, Firefox and Brave. The stolen session cookies are the dangerous part: they can let an attacker walk straight into your Microsoft 365 or banking portal without ever needing your password or an MFA code. Anyone running an internet-exposed, unpatched FortiClient EMS is a target — and it’s the kind of tool plenty of Australian businesses and their IT providers rely on.

Two things, today. First, make sure FortiClient EMS is on a patched version — Fortinet disclosed this flaw back in early April, so a fix is available. Second, assume anything left unpatched may already be compromised: check your EMS logs for unfamiliar admin accounts, odd logins and unexpected policy changes, then reset affected passwords and revoke active sessions across your cloud services. If card details were ever saved in a browser on an affected machine, cancel and reissue the card.

This is exactly the kind of thing managed endpoint security and monitoring is meant to catch — a trusted tool being quietly turned against you. If you’re not sure whether your Fortinet setup is patched, or who would even notice if it wasn’t, that’s worth a conversation. It’s also a sharp reminder for staff security training: not every “update” is the real thing.