OTX Threat: Fortinet Vulnerability CVE-2026-35616 and EKZ Stealer, Attacking Obfuscating Compilers with Binary Ninja Workflows

In May 2026, threat actors exploited CVE-2026-35616, an improper access control vulnerability in Fortinet EMS versions 7.4.5 through 7.4.6, to deploy EKZ Stealer within an energy sector organization. The malware was disguised as FortiEndpoint_Patch.exe and harvested browser credentials from Chromium-based browsers and Firefox before exfiltrating data via PowerShell to a command-and-control server. CVEs: CVE-2026-35616, CVE-2026-16232, CVE-2026-18577 Sectors: Energy