Cybercriminals have been caught using a tampered installer for the Exodus cryptocurrency wallet to plant a full remote access trojan. The program looks close enough to the real wallet, but it is designed so its window never appears.
The campaign reached victims through disguised files. One route used a fake PDF ending in .pdf.js, while another hid a JavaScript file in a ZIP archive. Opening the lure displayed a real decoy document while silently installing the altered wallet.
Researchers at Huntress identified the activity across four unrelated protected organizations between late July and mid-August 2026. Three compromises occurred within 85 minutes, showing how quickly the operation could be reused against targets.
The risk goes well beyond stolen coins. The hidden payload can take browser passwords and cookies, run commands, move files, provide remote desktop access, and turn a compromised computer into a proxy. That combination can support account takeover, surveillance, and deeper movement inside a network.
Huntress said in a report shared with Cyber Security News (CSN) that the campaign used a genuine Exodus 24.33.4 application as cover.
It resembles recent cases in which a fake Claude app malware campaign hid data theft inside a trusted-looking desktop program.
Hackers Hide a Full Remote Access Trojan
The malicious MSI installs nearly the entire legitimate wallet, but changes only three of its 1,973 bundled files. Its metadata calls the package “Background Service” from “Apple Inc,” even though those details are false.
The unsigned installer also drew no detections from 76 VirusTotal engines when Huntress analysed it. One altered script prevents the wallet from showing, focusing, or centering a window.
A second modified file acts as a loader, decrypting a 10 MB Windows payload into memory. This leaves victims with no visible wallet interface, while a real-looking Exodus process runs.
The payload is modular. Its components offer remote commands, file browsing and transfer, browser credential and cookie theft, a SOCKS proxy, hidden VNC access, and script execution.
Similar capabilities appeared in the ChonkyChicken browser theft campaign, showing how browser data can enable account takeover.
Rather than relying only on a conventional attacker server, the malware was observed using Azure Table Storage for tasking and results.
The report says it can also use WebSockets and includes dozens of configured lookalike hosts, although those additional hosts were not contacted in testing.
Persistence and response
The installer places the altered wallet in a per-user AppData location and starts it through explorer.exe, making the activity appear more like a user launch.
It then creates an ExdBackupTool scheduled task through Windows Task Scheduler interfaces, restarting Exodus.exe every hour. An INetHealth task clears the user’s proxy settings and refreshes Windows internet configuration.
That behavior can force its traffic to bypass a corporate proxy. It is a useful reminder that attackers increasingly combine stealth with familiar software, as seen in malicious browser extension campaign reports targeting credentials and wallet data.
Organizations should treat an affected device as a full interactive compromise, not a simple malware alert. Investigators should isolate the host, review other user profiles, and remove both the malicious directory and scheduled tasks.
Saved passwords, browser cookies, and active sessions should be considered exposed. Session tokens can remain usable after a password reset, so defenders should revoke sessions and rotate credentials from a clean device.
Users should enable visible file extensions and avoid opening downloaded JavaScript files disguised as documents. Teams should also alert on Windows Script Host launched from download folders, Electron programs running without a window, and software launched from AppData through explorer.exe.
Disabling the WebClient service where WebDAV is unnecessary can limit the search-ms delivery route. These safeguards complement fake crypto wallet screens that steal wallet and browser data.
The indicators are listed in the table below. Rapid containment matters because attackers may already have interactive access and stolen session data. They should be used alongside behavioral checks, because the attackers can rebuild installers and change hashes quickly.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Installer file | jn0101.msi |
Fake Exodus Backup Tool installer |
| SHA-256 | c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485 |
Hash of the unsigned malicious installer |
| SHA-256 | 8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a |
Hash of the decrypted memory-resident RAT payload |
| File | app.asar |
Trojanized Exodus 24.33.4 application bundle |
| File | debug.log |
Attacker build artifact that references C:123exodusUpdater |
| File path | %TEMP%<guid>.tmp.node |
koffi foreign-function module extracted at runtime |
| Package | @intelcorp/wmi-native-module |
NPM scope impersonating Intel, used for host reconnaissance |
| Module and SHA-256 | Dll4_fileman.dllfdd376562aac4be64fb635546a61e1912ff2c353360db73d2c553dcbb5a44f54 |
RAT file manager module |
| Module and SHA-256 | Dll4_socks.dll2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d |
RAT SOCKS proxy module |
| Module and SHA-256 | Dll4_cmd.dll84437d4239d2a3d90c4faad0a3c0630b2f61a40f7bbd12109bef74d7613b8756 |
RAT remote command module |
| Module and SHA-256 | Dll4_script.dll5274e93e35586a341d14b50cdf8413d59c51fd94f32bdc70bfdfb77198367603 |
RAT Lua script-execution module |
| Module and SHA-256 | Dll4_browser.dll7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8 |
Browser password, cookie, and extension theft module |
| Module and SHA-256 | Dll4_vnc.dll5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a |
Hidden VNC remote-control module |
| MSI ProductCode | {4046AD2B-3831-4011-AEAD-D98C5C9FD1EF} |
ProductCode associated with the malicious MSI |
| MSI UpgradeCode | {C4A1D8F2-3E5B-4C72-9A6D-1B8F0E27A3C9} |
UpgradeCode present in reversed GUID form under the Installer registry key |
| Installer metadata | DisplayName: Background ServicePublisher: Apple Inc |
False installer identity |
| Mutex | ExodusHelper |
Named mutex used as a single-instance guard |
| Scheduled task | INetHealth |
Clears ProxyEnable, ProxyServer, and AutoConfigURL to maintain direct C2 access |
| Scheduled task | ExdBackupTool |
Relaunches Exodus.exe from %APPDATA% every hour |
| MSI artifact | C:WindowsInstallerSourceHash{4046AD2B-3831-4011-AEAD-D98C5C9FD1EF} |
MSI source-hash file that can remain after directory removal |
| Runtime artifact | Exodus.exe running from %APPDATA%, parented by explorer.exe, with no visible window |
Runtime indicator of the altered Exodus application |
| IP address | 35[.]212[.]159[.]20 |
Hosted the MSI and resolved the delivery domain |
| Domain | us05[.]org |
Redirected visitors to a search-ms: URI |
| WebDAV path | \us05[.]org@8080update |
Remote share presented through a Windows Search Results window |
| URL | 35[.]212[.]159[.]20/jn0101.msi |
MSI download location used by the JavaScript dropper |
| C2 domain | lgapistorage123[.]table[.]core[.]windows[.]net |
Observed Azure Table Storage dead-drop channel, using table ftable434 |
| C2 domain | winapi[.]table[.]core[.]windows[.]net |
Additional Azure Table Storage account in the malware configuration |
| Configured C2 hosts | api.27inbarbadostours[.]comapi.504guaratv[.]comapi.b2compages[.]comapi.elcaminodesermadre[.]comapi.ideasnation[.]netapi.jyfgarriga[.]comapi.onemkscleaningsolutions[.]comapi.rezperfect[.]comapi.shopfoora[.]comapi.shuyinla[.]com |
Hosts configured in the RAT but not contacted during detonation |
| Configured C2 hosts | app.bcntextilrep[.]comapp.conviertenoensi[.]comapp.geutex[.]comapp.micheladafestelpaso[.]comapp.rtpsenior4djp[.]comapp.sentiented[.]comapp.shuchipharmacy[.]comapp.springstore[.]netapp.stateyatra[.]com |
Hosts configured in the RAT but not contacted during detonation |
| Configured C2 hosts | auth.SecureSwallow[.]comauth.SpeakToWinClients[.]comauth.auravp3[.]comauth.clubvp3[.]comauth.esalesrep[.]netauth.h-dsf1034[.]comauth.nailedbynakole[.]comauth.shuchimed[.]com |
Hosts configured in the RAT but not contacted during detonation |
| Configured C2 hosts | cdn.ShinoZen[.]comcdn.SpeakToGrowBiz[.]comcdn.baraldes[.]comcdn.cobraporganardinero[.]comcdn.estudiod2[.]comcdn.jiyaoglass[.]comcdn.planningportfolioweek[.]orgcdn.snsafirieik[.]comcdn.yenoox[.]com |
Hosts configured in the RAT but not contacted during detonation |
| Configured C2 hosts | static.AriesGlobalSoft[.]comstatic.TryTheCrowdMakers[.]comstatic.TurboLeadSlab[.]comstatic.cistecca360[.]comstatic.emialvarez[.]comstatic.gompl-rggsrve[.]comstatic.metodorace[.]comstatic.premios-king[.]comstatic.suplenation[.]com |
Hosts configured in the RAT but not contacted during detonation |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
The post Hackers Hide a Full Remote Access Trojan Inside a Real Exodus Crypto Wallet appeared first on Cyber Security News.