Cybercriminals have been caught using a tampered installer for the Exodus cryptocurrency wallet to plant a full remote access trojan. The program looks close enough to the real wallet, but it is designed so its window never appears.

The campaign reached victims through disguised files. One route used a fake PDF ending in .pdf.js, while another hid a JavaScript file in a ZIP archive. Opening the lure displayed a real decoy document while silently installing the altered wallet.

Researchers at Huntress identified the activity across four unrelated protected organizations between late July and mid-August 2026. Three compromises occurred within 85 minutes, showing how quickly the operation could be reused against targets.

The risk goes well beyond stolen coins. The hidden payload can take browser passwords and cookies, run commands, move files, provide remote desktop access, and turn a compromised computer into a proxy. That combination can support account takeover, surveillance, and deeper movement inside a network.

How an unopenable crypto wallet ends up installing a modular RAT to steal browser credentials (Source - Huntress) — How an unopenable crypto wallet ends up installing a modular RAT to steal browser credentials (Source – Huntress)

Huntress said in a report shared with Cyber Security News (CSN) that the campaign used a genuine Exodus 24.33.4 application as cover.

It resembles recent cases in which a fake Claude app malware campaign hid data theft inside a trusted-looking desktop program.

Hackers Hide a Full Remote Access Trojan

The malicious MSI installs nearly the entire legitimate wallet, but changes only three of its 1,973 bundled files. Its metadata calls the package “Background Service” from “Apple Inc,” even though those details are false.

The unsigned installer also drew no detections from 76 VirusTotal engines when Huntress analysed it. One altered script prevents the wallet from showing, focusing, or centering a window.

A second modified file acts as a loader, decrypting a 10 MB Windows payload into memory. This leaves victims with no visible wallet interface, while a real-looking Exodus process runs.

The 'Open Windows Explorer' browser prompt served by us05[.]org (Source - Huntress) — The ‘Open Windows Explorer’ browser prompt served by us05[.]org (Source – Huntress)

The payload is modular. Its components offer remote commands, file browsing and transfer, browser credential and cookie theft, a SOCKS proxy, hidden VNC access, and script execution.

Similar capabilities appeared in the ChonkyChicken browser theft campaign, showing how browser data can enable account takeover.

Rather than relying only on a conventional attacker server, the malware was observed using Azure Table Storage for tasking and results.

The report says it can also use WebSockets and includes dozens of configured lookalike hosts, although those additional hosts were not contacted in testing.

Persistence and response

The installer places the altered wallet in a per-user AppData location and starts it through explorer.exe, making the activity appear more like a user launch.

It then creates an ExdBackupTool scheduled task through Windows Task Scheduler interfaces, restarting Exodus.exe every hour. An INetHealth task clears the user’s proxy settings and refreshes Windows internet configuration.

That behavior can force its traffic to bypass a corporate proxy. It is a useful reminder that attackers increasingly combine stealth with familiar software, as seen in malicious browser extension campaign reports targeting credentials and wallet data.

Organizations should treat an affected device as a full interactive compromise, not a simple malware alert. Investigators should isolate the host, review other user profiles, and remove both the malicious directory and scheduled tasks.

Saved passwords, browser cookies, and active sessions should be considered exposed. Session tokens can remain usable after a password reset, so defenders should revoke sessions and rotate credentials from a clean device.

Users should enable visible file extensions and avoid opening downloaded JavaScript files disguised as documents. Teams should also alert on Windows Script Host launched from download folders, Electron programs running without a window, and software launched from AppData through explorer.exe.

Disabling the WebClient service where WebDAV is unnecessary can limit the search-ms delivery route. These safeguards complement fake crypto wallet screens that steal wallet and browser data.

The indicators are listed in the table below. Rapid containment matters because attackers may already have interactive access and stolen session data. They should be used alongside behavioral checks, because the attackers can rebuild installers and change hashes quickly.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Installer file	`jn0101.msi`	Fake Exodus Backup Tool installer
SHA-256	`c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485`	Hash of the unsigned malicious installer
SHA-256	`8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a`	Hash of the decrypted memory-resident RAT payload
File	`app.asar`	Trojanized Exodus 24.33.4 application bundle
File	`debug.log`	Attacker build artifact that references `C:\123\exodusUpdater`
File path	`%TEMP%\`	koffi foreign-function module extracted at runtime
Package	`@intelcorp/wmi-native-module`	NPM scope impersonating Intel, used for host reconnaissance
Module and SHA-256	`Dll4_fileman.dll` `fdd376562aac4be64fb635546a61e1912ff2c353360db73d2c553dcbb5a44f54`	RAT file manager module
Module and SHA-256	`Dll4_socks.dll` `2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d`	RAT SOCKS proxy module
Module and SHA-256	`Dll4_cmd.dll` `84437d4239d2a3d90c4faad0a3c0630b2f61a40f7bbd12109bef74d7613b8756`	RAT remote command module
Module and SHA-256	`Dll4_script.dll` `5274e93e35586a341d14b50cdf8413d59c51fd94f32bdc70bfdfb77198367603`	RAT Lua script-execution module
Module and SHA-256	`Dll4_browser.dll` `7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8`	Browser password, cookie, and extension theft module
Module and SHA-256	`Dll4_vnc.dll` `5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a`	Hidden VNC remote-control module
MSI ProductCode	`{4046AD2B-3831-4011-AEAD-D98C5C9FD1EF}`	ProductCode associated with the malicious MSI
MSI UpgradeCode	`{C4A1D8F2-3E5B-4C72-9A6D-1B8F0E27A3C9}`	UpgradeCode present in reversed GUID form under the Installer registry key
Installer metadata	`DisplayName: Background Service` `Publisher: Apple Inc`	False installer identity
Mutex	`ExodusHelper`	Named mutex used as a single-instance guard
Scheduled task	`INetHealth`	Clears `ProxyEnable`, `ProxyServer`, and `AutoConfigURL` to maintain direct C2 access
Scheduled task	`ExdBackupTool`	Relaunches `Exodus.exe` from `%APPDATA%` every hour
MSI artifact	`C:\Windows\Installer\SourceHash{4046AD2B-3831-4011-AEAD-D98C5C9FD1EF}`	MSI source-hash file that can remain after directory removal
Runtime artifact	`Exodus.exe` running from `%APPDATA%`, parented by `explorer.exe`, with no visible window	Runtime indicator of the altered Exodus application
IP address	`35[.]212[.]159[.]20`	Hosted the MSI and resolved the delivery domain
Domain	`us05[.]org`	Redirected visitors to a `search-ms:` URI
WebDAV path	`\\us05[.]org@8080\update`	Remote share presented through a Windows Search Results window
URL	`35[.]212[.]159[.]20/jn0101.msi`	MSI download location used by the JavaScript dropper
C2 domain	`lgapistorage123[.]table[.]core[.]windows[.]net`	Observed Azure Table Storage dead-drop channel, using table `ftable434`
C2 domain	`winapi[.]table[.]core[.]windows[.]net`	Additional Azure Table Storage account in the malware configuration
Configured C2 hosts	`api.27inbarbadostours[.]com` `api.504guaratv[.]com` `api.b2compages[.]com` `api.elcaminodesermadre[.]com` `api.ideasnation[.]net` `api.jyfgarriga[.]com` `api.onemkscleaningsolutions[.]com` `api.rezperfect[.]com` `api.shopfoora[.]com` `api.shuyinla[.]com`	Hosts configured in the RAT but not contacted during detonation
Configured C2 hosts	`app.bcntextilrep[.]com` `app.conviertenoensi[.]com` `app.geutex[.]com` `app.micheladafestelpaso[.]com` `app.rtpsenior4djp[.]com` `app.sentiented[.]com` `app.shuchipharmacy[.]com` `app.springstore[.]net` `app.stateyatra[.]com`	Hosts configured in the RAT but not contacted during detonation
Configured C2 hosts	`auth.SecureSwallow[.]com` `auth.SpeakToWinClients[.]com` `auth.auravp3[.]com` `auth.clubvp3[.]com` `auth.esalesrep[.]net` `auth.h-dsf1034[.]com` `auth.nailedbynakole[.]com` `auth.shuchimed[.]com`	Hosts configured in the RAT but not contacted during detonation
Configured C2 hosts	`cdn.ShinoZen[.]com` `cdn.SpeakToGrowBiz[.]com` `cdn.baraldes[.]com` `cdn.cobraporganardinero[.]com` `cdn.estudiod2[.]com` `cdn.jiyaoglass[.]com` `cdn.planningportfolioweek[.]org` `cdn.snsafirieik[.]com` `cdn.yenoox[.]com`	Hosts configured in the RAT but not contacted during detonation
Configured C2 hosts	`static.AriesGlobalSoft[.]com` `static.TryTheCrowdMakers[.]com` `static.TurboLeadSlab[.]com` `static.cistecca360[.]com` `static.emialvarez[.]com` `static.gompl-rggsrve[.]com` `static.metodorace[.]com` `static.premios-king[.]com` `static.suplenation[.]com`	Hosts configured in the RAT but not contacted during detonation

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Hide a Full Remote Access Trojan Inside a Real Exodus Crypto Wallet appeared first on Cyber Security News.