EKZ Stealer Masquerading as FortiEndpoint_Patch.exe

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•3

Detects the execution of a process named 'fortiendpoint_patch.exe' located outside the authorized Fortinet program files directory, which is indicative of potential masquerading by an adversary attempting to hide malicious activity under a legitimate-sounding process name.