EKZ Stealer: Non-Browser Process Accessing Chromium/Firefox Credential Stores

Ibrahim Saud@tektrix

•updated Jul 3, 2026•2•0•6

Detects credential harvesting behavior by non-browser processes attempting to access browser credential storage (Login Data/Local State files) and identifies execution of the masquerading binary 'FortiEndpoint_Patch.exe' and the creation of the 'log.txt' artifact in C:\ProgramData used by the EKZ Stealer.