EKZ Stealer PowerShell Download-Execute-Exfiltrate Chain (FortiBleed)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•2•0•9

Detects anomalous PowerShell activity associated with the EKZ Stealer, characterized by a multi-stage chain involving file download, hidden process execution, temporary file staging, base64 encoding, and exfiltration via HTTP POST requests, followed by cleanup of logs.