EKZ Stealer browser credential harvesting via FortiEndpoint_Patch.exe

Ibrahim Saud@tektrix

•updated Jul 3, 2026•2•0•2

Detects the EKZ Stealer malware (masquerading as 'FortiEndpoint_Patch.exe') attempting to access sensitive web browser files ('Login Data' and 'Local State') used to store credentials, and subsequently writing stolen information to 'C:\ProgramData\log.txt'.