Malicious Actors Distribute a Genuine Exodus Wallet Bundled with a Hidden Remote Access Trojan

Cybersecurity researchers have uncovered a malware campaign that abuses a modified version of the Exodus cryptocurrency wallet to secretly install a powerful remote access trojan (RAT) on victim systems. While the application closely resembles the legitimate Exodus wallet, it has been altered so that its user interface never appears, allowing the malware to operate unnoticed in the background.

The attackers distributed the malware through deceptive files designed to trick users into execution. One method involved a fake PDF file using a .pdf.js extension, while another delivered a JavaScript payload hidden inside a ZIP archive. Once opened, the lure displayed a legitimate-looking decoy document to avoid suspicion while silently installing the compromised wallet software. Researchers from Huntress observed the campaign targeting four unrelated organizations between late July and mid-August 2026. Notably, three of the intrusions occurred within an 85-minute period, highlighting the speed and scalability of the operation.

More Than Cryptocurrency Theft

Although the campaign uses a cryptocurrency wallet as its disguise, the malware's capabilities extend far beyond digital asset theft. The RAT can steal browser credentials and cookies, execute commands remotely, transfer files, provide hidden desktop access, and transform infected machines into proxy servers. These functions give threat actors the ability to conduct account takeovers, monitor victim activity, maintain persistent access, and potentially move laterally through corporate networks.

According to Huntress, the attackers leveraged a legitimate Exodus version 24.33.4 application as a cover for the malicious activity. The tactic mirrors recent malware operations that embedded malicious functionality inside trusted desktop applications to evade detection.

Minimal Changes, Maximum Impact

Analysis revealed that the malicious MSI installer contains nearly the entire legitimate Exodus wallet package, modifying only three files out of a total of 1,973 bundled components. To appear legitimate, the installer falsely identifies itself as a "Background Service" published by "Apple Inc."

At the time of investigation, the unsigned installer reportedly evaded detection by all 76 security engines available on VirusTotal. One altered script prevents the Exodus wallet window from launching or gaining focus, ensuring users never realize the application is running. Another modified file functions as a loader that decrypts and executes a 10 MB Windows payload directly in memory. As a result, victims see no wallet interface, while a seemingly legitimate Exodus process operates in the background.

Extensive Remote-Control Capabilities

The malware is highly modular and includes functionality for:

• Remote command execution
• File browsing and transfer
• Browser credential and cookie theft
• SOCKS proxy services
• Hidden VNC-based remote desktop access
• Script execution and automation

These capabilities provide attackers with near-complete control over compromised systems and can be leveraged for espionage, credential theft, or additional malware deployment.

Cloud Infrastructure Used for Command and Control

Rather than relying solely on traditional command-and-control servers, the malware was observed using Azure Table Storage to exchange instructions and exfiltrate results. Researchers also found support for WebSocket communications and numerous preconfigured lookalike domains, although those additional hosts were not contacted during testing.

The malware installs the modified wallet within the user's AppData directory and launches it through explorer.exe, helping the activity blend in with normal user behavior. To maintain persistence, it creates an ExdBackupTool scheduled task that restarts the malicious Exodus process every hour. Another scheduled task, named INetHealth, clears proxy settings and refreshes Windows internet configurations, potentially allowing malware traffic to bypass corporate monitoring controls.

Defensive Recommendations

Security teams should assume that affected systems are fully compromised rather than treating the incident as a simple malware infection. Recommended response actions include:

• Immediately isolating infected devices
• Reviewing all user profiles on affected systems
• Removing malicious directories and scheduled tasks
• Resetting credentials from clean devices
• Revoking active browser sessions and authentication tokens

Because stolen session cookies and tokens may remain valid after passwords are changed, organizations should terminate active sessions in addition to rotating credentials.

To reduce exposure, users should enable file extension visibility in Windows and avoid executing downloaded JavaScript files disguised as documents. Security teams should also monitor for:

• Windows Script Host processes launched from download folders
• Electron-based applications running without visible windows
• Programs executed from AppData through explorer.exe
• Unauthorized scheduled task creation

Organizations that do not rely on WebDAV may further reduce risk by disabling the Windows WebClient service, helping block one of the delivery methods used in the campaign. The incident serves as another example of how threat actors continue to abuse trusted software and familiar user workflows to deliver increasingly stealthy malware capable of full system compromise.