Critical Exodus Wallet Flaw Lets Attackers Install RATs

Key Takeaways

• Threat actors are distributing a malicious installer for the Exodus cryptocurrency wallet.
• The tampered installer deploys a sophisticated Remote Access Trojan (RAT) without displaying the wallet interface.
• The RAT is modular, capable of stealing browser credentials, cookies, files, and providing remote control.
• The campaign was observed across multiple organizations between late July and mid-August 2026.
• Users should update their Exodus wallet to a trusted version, enable visible file extensions, and exercise extreme caution with downloaded files.

Cybersecurity researchers have uncovered a sophisticated campaign in which attackers are distributing a modified installer for the popular Exodus cryptocurrency wallet. This deceptive package, while appearing legitimate, secretly deploys a full-featured Remote Access Trojan (RAT) onto victims’ systems, providing attackers with extensive control and data exfiltration capabilities.

The malicious installer is engineered to closely mimic the authentic Exodus wallet application but is designed to prevent its window from ever appearing. This stealthy approach ensures that victims remain unaware of the compromise while the underlying RAT establishes persistent access and begins its malicious operations.

Campaign Details and Delivery Methods

The campaign leverages various deceptive tactics to reach victims. One method involves disguising the malicious payload as a PDF file, typically ending with the unusual extension .pdf.js. Another technique utilizes ZIP archives containing JavaScript files. When a victim opens these lure files, a legitimate-looking decoy document is displayed, simultaneously and silently installing the tampered Exodus wallet in the background.

Security firm Huntress said in a report that its researchers detected this activity across four distinct, protected organizations between late July and mid-August 2026. Notably, three of these compromises occurred within an astonishing 85-minute window, highlighting the efficiency and reusability of the attackers’ operational methods.

Beyond Crypto Theft: A Full System Compromise

The implications of this attack extend far beyond the mere theft of cryptocurrency. The embedded RAT is highly modular and grants attackers a wide array of capabilities. These include harvesting browser passwords and cookies, executing arbitrary commands, manipulating files, facilitating remote desktop access, and even transforming the compromised machine into a SOCKS proxy. Such comprehensive control enables account takeovers, extensive surveillance, and deeper lateral movement within targeted networks.

The campaign employs a genuine Exodus 24.33.4 application as a cover, according to the Huntress analysis. This strategy mirrors other recent malware campaigns, such as those involving a fake Claude AI app, where data theft was concealed within seemingly trustworthy desktop programs.

Technical Deep Dive into the Malicious Installer

The malicious MSI installer incorporates nearly the entire legitimate Exodus wallet application but subtly alters only three of its 1,973 bundled files. To further evade detection, its metadata falsely identifies the package as “Background Service” from “Apple Inc.” Despite these deceptive attributes, the unsigned installer went undetected by all 76 VirusTotal engines when analyzed by Huntress.

One critical modification in a script prevents the wallet application from displaying, focusing, or centering any window. A second altered file functions as a loader, responsible for decrypting a 10 MB Windows payload directly into memory. This sophisticated technique leaves victims with no visible wallet interface, even as a legitimate-looking Exodus process runs in the background, masking the active RAT.

The RAT itself is highly modular, comprising various components designed for specific malicious functions. These include modules for remote command execution, file browsing and transfer, credential and cookie theft from browsers, a SOCKS proxy, hidden VNC access for remote control, and script execution capabilities. These functionalities are reminiscent of those observed in other browser data theft campaigns, underscoring how stolen browser information can be leveraged for extensive account takeovers.

Interestingly, the malware does not solely rely on conventional command-and-control (C2) servers. Instead, it was observed utilizing Azure Table Storage for tasking and exfiltrating results, a technique that can make detection more challenging. The report also notes that the malware is configured with dozens of lookalike hosts and can use WebSockets, though these additional communication channels were not observed during the testing phase. For detailed indicators of compromise, refer to the Huntress report.

Persistence and Evasion Techniques

To maintain persistence, the installer places the modified Exodus wallet in a per-user AppData directory and launches it via explorer.exe, making its activity appear as a legitimate user-initiated process. It then creates a scheduled task named “ExdBackupTool” through Windows Task Scheduler, which restarts Exodus.exe every hour. Another task, “INetHealth,” is created to clear the user’s proxy settings and refresh Windows internet configuration. This behavior effectively forces the malware’s traffic to bypass any corporate proxy, a stark reminder of how attackers are increasingly combining stealth with familiar software to evade detection.

What You Should Do

• Isolate and Investigate: Treat any affected device as a full interactive compromise. Immediately isolate the host from the network.
• Review and Remove: Thoroughly review other user profiles on the compromised machine and remove both the malicious directory and the scheduled tasks (ExdBackupTool and INetHealth).
• Credential Rotation and Session Revocation: Assume that all saved passwords, browser cookies, and active sessions on the compromised device are exposed. Rotate credentials and revoke all active sessions from a clean, trusted device. Session tokens can remain valid even after a password reset, making session revocation crucial.
• Enable Visible File Extensions: Configure Windows to always show file extensions to help identify disguised malicious files (e.g., .pdf.js).
• Avoid Opening Suspicious Files: Exercise extreme caution with downloaded JavaScript files, especially those disguised as documents.
• Monitor for Anomalous Activity: Implement alerts for suspicious activities such as Windows Script Host launching from download folders, Electron applications running without a visible window, and software launched from AppData via explorer.exe.
• Disable WebClient Service: If WebDAV functionality is not required, consider disabling the WebClient service to mitigate the search-ms: delivery route used by some attackers.
• Utilize Behavioral Checks: While IoCs are valuable, attackers can quickly change hashes and rebuild installers. Complement IoC-based detection with robust behavioral analysis to identify evolving threats.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.