Hackers Hide a Full Remote Access Trojan Inside a Real Exodus Crypto Wallet

Cybercriminals have been caught using a tampered installer for the Exodus cryptocurrency wallet to plant a full remote access trojan. The program looks close enough to the real wallet, but it is designed so its window never appears.

The campaign reached victims through disguised files. One route used a fake PDF ending in .pdf.js, while another hid a JavaScript file in a ZIP archive. Opening the lure displayed a real decoy document while silently installing the altered wallet.

Researchers at Huntress identified the activity across four unrelated protected organizations between late July and mid-August 2026. Three compromises occurred within 85 minutes, showing how quickly the operation could be reused against targets.

The risk goes well beyond stolen coins. The hidden payload can take browser passwords and cookies, run commands, move files, provide remote desktop access, and turn a compromised computer into a proxy. That combination can support account takeover, surveillance, and deeper movement inside a network.

Huntress said in a report shared with Cyber Security News (CSN) that the campaign used a genuine Exodus 24.33.4 application as cover.

It resembles recent cases in which a fake Claude app malware campaign hid data theft inside a trusted-looking desktop program.

Hackers Hide a Full Remote Access Trojan

The malicious MSI installs nearly the entire legitimate wallet, but changes only three of its 1,973 bundled files. Its metadata calls the package “Background Service” from “Apple Inc,” even though those details are false.

The unsigned installer also drew no detections from 76 VirusTotal engines when Huntress analysed it. One altered script prevents the wallet from showing, focusing, or centering a window.

A second modified file acts as a loader, decrypting a 10 MB Windows payload into memory. This leaves victims with no visible wallet interface, while a real-looking Exodus process runs.

The payload is modular. Its components offer remote commands, file browsing and transfer, browser credential and cookie theft, a SOCKS proxy, hidden VNC access, and script execution.

Similar capabilities appeared in the ChonkyChicken browser theft campaign, showing how browser data can enable account takeover.

Rather than relying only on a conventional attacker server, the malware was observed using Azure Table Storage for tasking and results.

The report says it can also use WebSockets and includes dozens of configured lookalike hosts, although those additional hosts were not contacted in testing.

Persistence and response

The installer places the altered wallet in a per-user AppData location and starts it through explorer.exe, making the activity appear more like a user launch.

It then creates an ExdBackupTool scheduled task through Windows Task Scheduler interfaces, restarting Exodus.exe every hour. An INetHealth task clears the user’s proxy settings and refreshes Windows internet configuration.

That behavior can force its traffic to bypass a corporate proxy. It is a useful reminder that attackers increasingly combine stealth with familiar software, as seen in malicious browser extension campaign reports targeting credentials and wallet data.

Organizations should treat an affected device as a full interactive compromise, not a simple malware alert. Investigators should isolate the host, review other user profiles, and remove both the malicious directory and scheduled tasks.

Saved passwords, browser cookies, and active sessions should be considered exposed. Session tokens can remain usable after a password reset, so defenders should revoke sessions and rotate credentials from a clean device.

Users should enable visible file extensions and avoid opening downloaded JavaScript files disguised as documents. Teams should also alert on Windows Script Host launched from download folders, Electron programs running without a window, and software launched from AppData through explorer.exe.

Disabling the WebClient service where WebDAV is unnecessary can limit the search-ms delivery route. These safeguards complement fake crypto wallet screens that steal wallet and browser data.

The indicators are listed in the table below. Rapid containment matters because attackers may already have interactive access and stolen session data. They should be used alongside behavioral checks, because the attackers can rebuild installers and change hashes quickly.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Hide a Full Remote Access Trojan Inside a Real Exodus Crypto Wallet appeared first on Cyber Security News.