How to remove EKZ Stealer from the operating system

What kind of malware is EKZ Stealer?

EKZ Stealer is an information stealer designed to silently extract saved passwords, cookies, autofill data, and payment card details from web browsers on infected Windows computers. According to research by Arctic Wolf, it was first observed in May 2026 as part of a campaign targeting organizations that use Fortinet's FortiClient EMS software.

To deliver the stealer, attackers disguised it as a legitimate Fortinet software update named FortiEndpoint_Patch.exe. The file was pushed to managed endpoints automatically through tampered VPN profile configurations, meaning victims typically had no idea the malware was being installed.

EKZ Stealer overview

The malware targets both Chromium-based browsers (such as Chrome and Edge) and Firefox-based browsers, including LibreWolf, Waterfox, Pale Moon, and Thunderbird. From these applications, it collects saved login credentials, session cookies, autofill data, and saved credit card numbers.

Once collection is complete, harvested data is written to a log file on the victim's machine and then sent to a server controlled by the attackers over an HTTP connection. The stealer supports repeated use across multiple hosts via a command-line interface, suggesting it is used in targeted, operator-driven operations.

The campaign Arctic Wolf documented exploited CVE-2026-35616, a vulnerability in FortiClient EMS that gave unauthenticated access to the server's management API. Attackers used that foothold to modify VPN profile configurations, injecting malicious PowerShell commands that were automatically executed on all managed endpoints when a VPN connection was made.

How EKZ Stealer steals browser data

Chromium-based browsers encrypt saved passwords using a protection tied to the Windows user account. EKZ Stealer bypasses this by copying itself into the browser's own application folder and relaunching from that location, which causes the browser to treat it as a trusted internal process.

From that position, it calls a privileged browser function to retrieve the AES-256 decryption key used to protect stored credentials. This allows the stealer to read every saved password in the browser without any warning to the user.

Defense evasion

EKZ Stealer takes steps to hinder analysis and remove traces of the infection. Its executable has a zeroed build timestamp, which removes the date marker normally used by researchers to determine when a program was compiled.

The malware was also delivered via Base64-encoded PowerShell scripts, which can bypass filters that scan for recognizable malicious commands. After exfiltration completes, the stealer deletes the payload file and cleans up related log entries, erasing evidence of the infection.

Conclusion

Victims of EKZ Stealer can lose all credentials stored in their browsers, including account passwords, payment card data, and session cookies that may allow attackers to access accounts without needing the original password. Any accounts active in the browser at the time of infection should be considered potentially compromised.

The stealer's cleanup routine makes it difficult to confirm an infection after the fact, and organizations affected by the FortiClient EMS vulnerability may have had it deployed across many devices at once. EKZ Stealer should be removed from the system immediately.

More examples of stealers are DebugElevator, Evolution, and Needle.

How did EKZ Stealer infiltrate my computer?

According to Arctic Wolf, the EKZ Stealer campaign exploited CVE-2026-35616, a vulnerability in Fortinet's FortiClient EMS that allowed unauthenticated access to the server's management API. Attackers gained administrative control and modified VPN profile settings to inject malicious PowerShell scripts into the configuration.

These scripts were executed automatically on all managed endpoints whenever a VPN connection was established. The payload was named FortiEndpoint_Patch.exe, and to most users and administrators it would look like a routine Fortinet software update rather than malware.

Outside of this specific campaign, stealers commonly reach users through phishing emails, fake software download sites, pirated software, and software cracks.

How to avoid installation of malware?

Keep all software up to date, including network management tools and VPN clients. Vulnerabilities like CVE-2026-35616 are patched by vendors once discovered, but devices must actually receive and apply those patches to be protected. Only download software updates directly from official vendor websites.

Be cautious with unexpected emails that contain attachments or links, even when they appear to come from a trusted source. Use reputable antivirus software and scan regularly for threats. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Quick menu:

• What is EKZ Stealer?
• STEP 1. Manual removal of EKZ Stealer malware.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with EKZ Stealer malware, should I format my storage device to get rid of it?

Formatting removes EKZ Stealer but also erases all data on the drive. Running a reputable security tool like Combo Cleaner is the recommended first step; formatting should only be considered as a last resort.

What are the biggest issues that EKZ Stealer malware can cause?

EKZ Stealer can result in the theft of all saved browser passwords, session cookies, and payment card data. This can lead to account takeover, identity theft, and financial fraud, especially if stolen credentials include banking or email accounts.

What is the purpose of EKZ Stealer malware?

The purpose of EKZ Stealer is to harvest saved credentials and sensitive data from web browsers, including passwords, cookies, autofill data, and payment card details, and send that information to the attackers for exploitation.

How did EKZ Stealer malware infiltrate my computer?

EKZ Stealer was observed spreading through a campaign that exploited CVE-2026-35616, a FortiClient EMS vulnerability. Attackers injected malicious PowerShell scripts into VPN configurations, causing the stealer to execute automatically on managed endpoints without any user action.

Will Combo Cleaner protect me from malware?

Yes. Combo Cleaner can detect and remove most known malware, including information stealers. Running a full system scan is recommended to ensure that no threats are missed and the system is thoroughly clean.